Star Blizzard Phishing Campaign Deploys CosmicPulse Backdoor via RedFlick Scheduled‑Task Technique Across 100+ Organizations
What Happened – Russian APT group Star Blizzard expanded its phishing operations with a new “RedFlick” delivery method. The technique creates Windows scheduled tasks that silently install the CosmicPulse backdoor on compromised hosts. Over 100 distinct organizations have been observed as targets.
Why It Matters for Trust & Control Assurance –
- The RedFlick approach bypasses traditional email‑gateway detections, highlighting the need for continuous security‑awareness training that can be audited for effectiveness.
- Scheduled‑task creation is a low‑noise indicator of compromise; monitoring and logging this activity satisfies a core control‑assurance objective for evidence‑based audit readiness.
- Demonstrates the importance of a defensible evidence trail that links user‑focused training outcomes to technical detections.
Who Is Affected – Multiple sectors; any organization that relies on Windows workstations and email communications.
Recommended Actions –
- Deploy regular phishing simulations and mandatory security‑awareness training for all users.
- Enforce multi‑factor authentication for privileged accounts.
- Implement endpoint detection that alerts on new scheduled‑task creation.
- Establish continuous logging and monitoring of task‑scheduler activity to provide audit‑ready evidence.
Source: HackRead – Star Blizzard Phishing Campaign
Technical Notes – The RedFlick technique leverages Windows Task Scheduler (schtasks) to execute the CosmicPulse payload, a custom backdoor capable of remote command execution and data exfiltration. No specific CVE is cited; the vector is a social‑engineering phishing email with a malicious attachment or link. Source: same as above