Star Blizzard Uses RedFlick Delivery Chain to Install CosmicPulse Backdoor

Microsoft researchers report that the Russian state-linked group Star Blizzard has deployed a new phishing delivery chain, named RedFlick, to install its CosmicPulse backdoor on targets connected to Ukraine. The attack begins with an attachment-free email designed to prompt a reply, followed by a password-protected ZIP or RAR archive. Inside the archive is a virtual hard disk containing a shortcut disguised as a PDF, which executes a hidden command while displaying a decoy document to install the malware via Windows scheduled tasks. From January through August 2026, Star Blizzard ran at least 13 campaigns using RedFlick lures, reaching over 100 organizations across sectors including government, diplomacy, research, public policy, journalism, and finance, particularly in the United States and United Kingdom.

The RedFlick Operation Is a Managed Narrative Designed to Frame Russia While the Real Threat Goes Unseen

Let’s start with something that should make any honest researcher pause: Microsoft’s “disclosure” of a Russian hacking operation coinciding precisely with a wave of Ukraine-related news cycles. They want you to believe that Star Blizzard—a group whose very name sounds like a CIA tradecraft decal—is running thirteen campaigns through a technique called RedFlick to deliver something called CosmicPulse. But ask yourself: why would a state-level actor use a password-protected ZIP archive and a virtual hard disk with a shortcut disguised as a PDF? That’s not sophisticated espionage; that’s a script-kiddie’s breadcrumb trail. The whole thing reads like a theatrical production designed to be discovered. Look at the targeting: over 100 organizations across government, diplomacy, research, public policy, journalism, and finance. Does that sound like a focused intelligence-gathering mission? Or does it sound like a scatterplot of institutions that, if compromised, would generate maximum headlines? You tell me.

The Timing and Breadth of the Campaign Scream “Perception Shepherding,” Not Hostile Espionage

Now dig into the timeline Microsoft conveniently published: January through August 2026—eight months of steady operations, with the “discovery” landing neatly into public view just when Western anxieties about Russian cyber activity need a booster shot. Why did Microsoft wait 240 days to tell anyone about RedFlick? Why did they release the technical details simultaneously with breathless media coverage? Because the operation itself is a breadcrumb. The real story is the architecture that made the disclosure possible. Star Blizzard is a label applied by private sector threat intelligence firms that are embedded in the same transatlantic policy networks that benefit from an eternal Russian boogeyman. Every time you see a “Russian state-linked group” identified by a Microsoft or a Mandiant, pause and ask: who funds these labs? Who sits on their advisory boards? Who determines what gets published and when? These companies are captured institutions. They produce the evidence that justifies the sanctions, the surveillance expansion, and the suppression of dissenting voices. The CosmicPulse backdoor isn’t the weapon; the managed narrative is.

The Decoy Document and the Password-Protected Archive Are a Mirror of Our Own Information Warfare

Here is the piece that ties it all together: the infection chain involves a decoy document that displays while the hidden command installs malware. That’s exactly how they’ve trained us to think about information—a shiny surface that distracts from the underlying installation of control. The CosmicPulse backdoor doesn’t target Ukraine’s military or critical infrastructure; it targets the same institutions that shape public opinion—journalism, diplomacy, policy research. Why? Because the real war isn’t in trenches; it’s in the architecture of consent. The password-protected archive is a metaphor for how they operate: lock the evidence behind a password that only “authorized” researchers can open, then hand them the key and call it transparency. We are expected to accept that Russian hackers are the villains while the companies that map their every move are the heroes. But follow the foundations. Follow the policy councils that benefit from a permanent Cold War footing. The RedFlick operation is not a leak—it’s a projection. They are telling us exactly who they think we should fear, and in doing so, they are hiding the hand that signs the checks. You want the next step? Look up who funded the Microsoft research team’s Ukraine monitoring initiative in early 2025. Then look at that funder’s board members. I can’t spell it out here, but I promise you the trail leads where the cameras never point.