Russian State Actor Star Blizzard Deploys “RedFlick” Malware Delivery Chain via Phishing
What Happened — Star Blizzard introduced a new delivery method called RedFlick that begins with a phishing email containing a password‑protected archive. The archive holds a VHDX virtual disk with an LNK file masquerading as a PDF; opening it launches a hidden command that installs scheduled‑task components and ultimately drops the CosmicPulse backdoor via the NOROBOT/BAITSWITCH downloader.
Why It Matters for Trust & Control Assurance
- The technique exploits the human element and weak attachment‑handling policies—exactly the scenario a continuous security‑awareness program is built to detect, document, and remediate.
- Evidence of phishing‑email triage, attachment scanning, and execution‑prevention controls provides a defensible audit trail for identity‑access and user‑behavior controls.
- Mapping this attack to the “identity and access control” objective shows how automated monitoring of scheduled‑task creation and privileged command execution can surface the chain early, supporting continuous control‑assurance.
Who Is Affected — Enterprises across finance, technology, healthcare, and government that rely on Windows workstations and accept email attachments from external parties.
Recommended Actions
- Enforce strict attachment‑type filtering and sandbox analysis for archives, especially password‑protected ZIP/RAR files.
- Deploy endpoint detection that flags creation of scheduled tasks with suspicious names or locations.
- Refresh security‑awareness training to highlight LNK‑file masquerading and the need to verify PDF sources before opening.
Technical Notes – Attack vector: phishing email → password‑protected archive → VHDX with LNK → hidden command → MSI installer → three scheduled tasks (Internet Quality Test Connection, Network Configuration Manager, System Health Monitor) → downloader (NOROBOT/BAITSWITCH) → CosmicPulse backdoor. Source: BleepingComputer