Russian state-sponsored group Star Blizzard has been using the RedFlick infection technique in recent CosmicPulse attacks.

The Russian state actor Star Blizzard has been using a new malware installation tactic dubbed "RedFlick" to deploy its signature CosmicPulse backdoor.

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromis...

CYFIRMA profiles Star Blizzard's 2023–2026 espionage activity, detailing RedFlick delivery, malware and phishing, with hunting queries and mitigations…

Star Blizzard uses fake event invites and RedFlick scheduled tasks to install CosmicPulse on Windows systems tied to Ukraine.

Introduction: A Persistent Espionage Operation Targets Organizations Worldwide Cybersecurity researchers are continuing to track the activities of Star Blizzard, a threat actor associated with persistent cyberespionage operations that rely on phishing, malicious delivery mechanisms and malware to gain access to targeted environments. A new analysis attributed to CYFIRMA examines the group's activity between 2023 and 2026, highlighting its reported use of the RedFlick delivery chain, malware-related techniques and phishing infrastructure.

Russian group Star Blizzard expands phishing campaigns with a new malware delivery RedFlick technique, using scheduled tasks to deliver the CosmicPulse backdoor.

Russian group Star Blizzard expands phishing campaigns with the RedFlick technique, using scheduled tasks to deliver the CosmicPulse backdoor.

Russian group Star Blizzard expands phishing campaigns with the RedFlick technique, using scheduled tasks to deliver the CosmicPulse backdoor.

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique, tracked by Microsoft as “RedFlick”.

Russian group Star Blizzard expands phishing campaigns with the RedFlick technique, using scheduled tasks to deliver the CosmicPulse backdoor.

Les cyberattaques russes reposent désormais sur une toute nouvelle tactique. Microsoft vient de lever le voile sur cette nouvelle stratégie criminelle, intitulée RedFlick, qui permet d'infecter un ord...

Russian group Star Blizzard expands phishing campaigns with a new malware delivery RedFlick technique, using scheduled tasks to deliver the CosmicPulse backdoor.

Les cyberattaques russes reposent désormais sur une toute nouvelle tactique. Microsoft vient de lever le voile sur cette nouvelle stratégie criminelle, intitulée RedFlick, qui permet d'infecter un ord...

The state-sponsored group has launched larger-scale phishing campaigns to deploy the CosmicPulse backdoor.

Plus de 100 organisations ciblées par au moins 13 campagnes en 2026 Le groupe Star Blizzard piège via une correspondance sans pièce jointe L’archive protégée par mot de passe installe le backdoor…

The Russian state actor Star Blizzard has been using a new malware installation tactic dubbed "RedFlick" to deploy its signature CosmicPulse backdoor.

Microsoft warns that Star Blizzard is using RedFlick and Windows scheduled tasks to deploy the CosmicPulse backdoor in targeted attacks.

Le groupe de cyberespionnage russe Star Blizzard a drastiquement modifié ses méthodes d'attaque en 2026. En déployant une nouvelle technique de livraison nommée RedFlick, ces pirates informatiques abandonnent l'approche complexe au profit d'une infection automatisée en un seul clic pour installer leur porte dérobée CosmicPulse. Les cibles se multiplient à grande vitesse à travers le monde.