[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzZdiM0uNFHPhElYnNNEUaBWY3bZ_NDZwWuQgS1u9PVY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"bf6b6d65-8687-42ca-b019-4fb82840496e","star-blizzards-redflick-technique-abuses-virtual-disks-and-lnk-files-to-deploy-backdoor","eaec4a1d-7922-41d9-86bb-dccea9a4de2e","Star Blizzard's RedFlick Technique Abuses Virtual Disks and LNK Files to Deploy Backdoor","Russian state-sponsored group Star Blizzard has weaponized a sophisticated multi-stage attack chain — dubbed RedFlick — that begins with a phishing email and leverages password-protected archives, VHDX virtual disk files, malicious LNK shortcuts, and MSI installers to silently deploy the CosmicPulse backdoor. The use of password-protected archives is specifically designed to bypass email gateway scanning, while VHDX files bypass Mark-of-the-Web (MotW) protections that would normally warn users about untrusted content. Scheduled tasks are then used to establish persistence and evade endpoint detection tools. This attack highlights how social engineering, combined with abuse of legitimate Windows features, can circumvent multiple layers of traditional defenses. Organizations that lack user training, endpoint telemetry, and restrictive execution policies remain highly exposed to this class of threat.","**Immediate actions:**\n- Block or quarantine inbound password-protected archive files (ZIP, RAR, 7z) at the email gateway and require manual review before delivery.\n- Disable or restrict VHDX\u002FVHD auto-mounting via Group Policy to prevent virtual disk-based MotW bypass attacks.\n- Enable and enforce Windows Defender Attack Surface Reduction (ASR) rules to block LNK-based execution of malicious scripts and MSI installers.\n\n**Long-term improvements:**\n- Conduct regular phishing simulation exercises focused on spear-phishing scenarios involving file attachments to build user recognition of this attack vector.\n- Implement application whitelisting (e.g., AppLocker or WDAC) to prevent unauthorized MSI installers and scheduled task creation by non-administrative processes.\n- Enforce the principle of least privilege so that standard users cannot mount virtual disks or register scheduled tasks without elevated approval.\n\n**Detection measures:**\n- Monitor and alert on unusual scheduled task creation events (Windows Event IDs 4698, 4702) from non-standard parent processes.\n- Deploy EDR\u002FXDR tooling with behavioral detection rules targeting LNK-to-MSI-to-scheduled-task execution chains.\n- Centralize and correlate endpoint logs in a SIEM with threat intelligence feeds referencing Star Blizzard\u002FSEABORGIUM indicators of compromise.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 9 – Email and Web Browser Protections","CIS Control 10 – Malware Defenses","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 AU-12 – Audit Record Generation","NIST SP 800-53 SC-18 – Mobile Code","MITRE ATT&CK T1566.001 – Phishing: Spearphishing Attachment","MITRE ATT&CK T1553.005 – Subvert Trust Controls: Mark-of-the-Web Bypass","MITRE ATT&CK T1053.005 – Scheduled Task\u002FJob: Scheduled Task","MITRE ATT&CK T1218.007 – System Binary Proxy Execution: Msiexec",{},"published","2026-09-30T22:20:43.838504+00:00","2026-09-30T22:20:43.565+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Frussian-state-hackers-use-new-redflick-technique-to-push-malware\u002F","russian-state-hackers-use-new-redflick-technique-to-push-malware-2d28f4","Russian state hackers use new RedFlick technique to push malware",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":40,"name":41,"slug":42,"description":43,"color":44},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":46,"name":47,"slug":48,"description":49,"color":50},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[53,57,61],{"slug":54,"name":55,"problem":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":58,"name":59,"problem":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":62,"name":63,"problem":64},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]