Russian Group Star Blizzard Adopts Simpler 'RedFlick' Technique to Deliver Backdoor

Since January 2026, Microsoft has observed the Russian state-backed group Star Blizzard change how it avoids detection. The group has run large-scale phishing campaigns, used accounts on compromised websites, and introduced a new malware delivery technique that Microsoft tracks as RedFlick. Microsoft describes this as a notable shift in the group's operational tradecraft.

RedFlick uses a set of scheduled tasks to deploy the group's custom backdoor, CosmicPulse. It replaces the group's earlier ClickFix-based infection chains, which required victims to complete several actions before the backdoor could be installed. RedFlick needs only a single user interaction, which lowers the effort needed to compromise a target. Combined with the move to large-scale phishing, Microsoft assesses these changes likely help the group reach more targets, evade detection and improve its chances of success.

The activity supports ongoing cyberespionage against Ukrainian individuals and institutions, as well as international NGOs, Western think tanks, governments and other organisations involved in international policy, particularly those supporting Ukraine. Microsoft's full blog provides updated technical analysis of the group's phishing, persistence and malware delivery techniques, along with recommendations, indicators of compromise, detections and hunting guidance. Microsoft notes it directly notifies customers who have been targeted or compromised by nation-state actors.