Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In September 2026, Microsoft researchers identified a new malware delivery technique called 'RedFlick' being used by the Russian state-sponsored threat actor Star Blizzard (also known as COLDRIVER). This campaign represents a significant evolution in the group's tactics, streamlining their malware delivery process through automated scheduled tasks that deploy the CosmicPulse backdoor with minimal victim interaction. The attacks begin with phishing emails containing password-protected archives that house VHDX virtual disks with malicious LNK files disguised as PDFs. Microsoft observed at least 13 large-scale campaigns since early 2026, impacting over 100 organizations primarily in the US and UK, with particular focus on Ukrainian institutions and international organizations supporting Ukraine.

This incident highlights the ongoing sophistication of state-sponsored cyber operations and the continuous evolution of attack methodologies. As geopolitical tensions remain high, organizations must prepare for increasingly automated and evasive attack chains that bypass traditional security controls through legitimate system utilities and scheduled task abuse.

Why This Matters Now

State-sponsored threat actors are rapidly automating their attack chains to reduce detection and victim interaction requirements, making traditional email security and user training less effective against sophisticated nation-state campaigns targeting critical infrastructure and diplomatic organizations.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

RedFlick significantly reduces required victim interaction by automating the infection chain through scheduled tasks, whereas previous ClickFix campaigns required multiple manual victim actions to complete the infection process.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely constrain Star Blizzard's RedFlick campaign by limiting lateral movement through microsegmentation and reducing the blast radius of their CosmicPulse backdoor operations across targeted infrastructure.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Initial malware execution would likely still occur on the endpoint, but subsequent network communication attempts from the compromised workload would be subject to identity-aware routing policies that could limit the scope of reconnaissance activities.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: The scheduled tasks would likely gain local system privileges, but their network access would be constrained by microsegmentation policies that limit cross-workload communication based on verified identity rather than assumed network trust.

Lateral Movement

Control: East-West Traffic Security

Mitigation: WebDAV reconnaissance activities would likely be constrained by east-west traffic inspection that could block unauthorized file-sharing protocols and limit the attacker's ability to map internal network resources across different workload segments.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: The BAITSWITCH downloader's command and control communications would likely be subject to centralized visibility and policy enforcement that could limit the backdoor's ability to maintain persistent channels across different cloud environments.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Data exfiltration attempts would likely be constrained by egress policy enforcement that could block unauthorized outbound transfers and limit the volume or types of sensitive documents that can be transmitted to external infrastructure.

Impact (Mitigations)

The overall impact to Ukrainian institutions and supporting organizations would likely be reduced in scope, with attackers maintaining access primarily to initially compromised workloads rather than achieving broad network compromise.

Impact at a Glance

Affected Business Functions

  • Diplomatic Communications
  • Financial Operations
  • Policy Development
  • International Relations
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: N/A

Data Exposure

Sensitive diplomatic communications, government documents, NGO financial records, think tank research, and institutional communications from Ukrainian organizations and international entities supporting Ukraine. The CosmicPulse backdoor enables document retrieval and execution of arbitrary Python code for ongoing data exfiltration.

Recommended Actions

  • • Implement egress security and policy enforcement to block unauthorized outbound connections from scheduled tasks and prevent CosmicPulse backdoor communications
  • • Deploy zero trust segmentation with least privilege policies to contain lateral movement and limit WebDAV-based reconnaissance activities
  • • Enable multicloud visibility and control to detect anomalous automation patterns from scheduled maintenance tasks and suspicious Python execution
  • • Activate threat detection and anomaly response capabilities to identify covert remote access tools and baseline deviations in system behavior
  • • Enforce encrypted traffic inspection to analyze MSI installer communications and detect malicious payload delivery mechanisms

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image