Tia N.List

CTI · reviewed · 2026-10-02

Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks

Full story & timeline

Actors

Star BlizzardFSB Centre 18

Malware / tools

CosmicPulseLostKeys

Campaigns

RedFlick

CVEs

—

Victim sectors

governmentdefenseeducationnon-profit

Geography

United StatesUnited KingdomUkraine

MITRE ATT&CK

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Star Blizzard RedFlick Scheduled Task Installation
id: 70a2af5b-b4df-4985-9d3a-77deb6839f1a
status: experimental
description: >
    Detects process command lines that create or query the scheduled task
    names installed by the Star Blizzard RedFlick infection chain to stage
    and run the CosmicPulse Python backdoor (Microsoft Threat Intelligence,
    September 2026): "Internet Quality Test Connection" (collects host and
    user name, can run a remote DLL), "Network Configuration Manager"
    (prepares WebDAV for remote file-style paths) and "System Health
    Monitor" (launches control.exe), plus the SecureDNSObserver task
    documented in the earlier Ukraine Recovery Conference lure chain.
    RedFlick is delivered by a password-protected ZIP/RAR containing a VHDX
    and an LNK disguised as a PDF after a single user interaction.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/
    - https://www.bleepingcomputer.com/news/security/russian-state-hackers-use-new-redflick-technique-to-push-malware/
    - https://dslua.org/publications/spearphishing-via-fake-urc-2026-invitations-targets-ukrainian-csos/
author: Tia N. List
date: 2026/10/02
tags:
    - attack.t1566
    - attack.t1204
    - attack.t1059
    - attack.t1053
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_process:
        Image|endswith:
            - '\schtasks.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
    selection_taskname:
        CommandLine|contains:
            - 'Internet Quality Test Connection'
            - 'Network Configuration Manager'
            - 'System Health Monitor'
            - 'SecureDNSObserver'
    condition: selection_process and selection_taskname
falsepositives:
    - Enterprise maintenance tooling that registers tasks with these generic names
    - Administrators querying or troubleshooting the same task names
level: medium
---
title: Star Blizzard RedFlick Infrastructure Beaconing
id: b4a27d1e-0c39-47a6-9d10-2e5f5c8a91d7
status: experimental
description: >
    Detects network connections to infrastructure documented for the Star
    Blizzard RedFlick chain: C2 address 103.245.213.217 reported by
    Microsoft Threat Intelligence, WebDAV delivery host 89.125.66.183 and
    remote command source 103.160.59.97 from the earlier Ukraine Recovery
    Conference lure chain, and the secure-dns-hub.com remote command domain.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/
    - https://dslua.org/publications/spearphishing-via-fake-urc-2026-invitations-targets-ukrainian-csos/
author: Tia N. List
date: 2026/10/02
tags:
    - attack.t1566
    - attack.t1105
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - 103.245.213.217
            - 89.125.66.183
            - 103.160.59.97
    selection_host:
        DestinationHostname|endswith: 'secure-dns-hub.com'
    condition: 1 of selection_*
falsepositives:
    - None known; the addresses and domain are documented Star Blizzard infrastructure
level: high

YARA-X raw

rule StarBlizzard_RedFlick_CosmicPulse {
    meta:
        author = "Tia N. List"
        date = "2026-10-02"
        status = "experimental"
        description = "Artifacts of the Star Blizzard (FSB Centre 18) RedFlick infection chain used to install the CosmicPulse Python backdoor: the three maintenance-lookalike scheduled task names installed by the chain MSI, the SecureDNSObserver task from the earlier URC-2026 lure, the HKCU registry staging key, and documented WebDAV/C2 infrastructure. Derived from Microsoft Threat Intelligence and Digital Security Lab Ukraine case analysis — NOT validated against a live sample."
        reference = "https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/"
        falsepositives = "Network Configuration Manager and System Health Monitor are generic task names used by legitimate tooling; require at least two matched strings and corroborate with process or network telemetry"
    strings:
        $task1 = "Internet Quality Test Connection" ascii nocase
        $task2 = "Network Configuration Manager" ascii nocase
        $task3 = "System Health Monitor" ascii nocase
        $task4 = "SecureDNSObserver" ascii
        $reg1 = "Software\\Classes\\.mollis" ascii nocase
        $c2a = "103.245.213.217" ascii
        $c2b = "89.125.66.183" ascii
        $c2c = "103.160.59.97" ascii
        $dom1 = "secure-dns-hub.com" ascii nocase
    condition:
        2 of ($task*) or (any of ($task*) and 2 of ($reg1, $c2a, $c2b, $c2c, $dom1))
}

References

Source on GitHub