Date: September 29, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Advanced Persistent Threats (APT) / Nation-State Espionage / Malware Analysis
Tags: Star Blizzard, FSB Centre 18, SEABORGIUM, COLDRIVER, RedFlick, CosmicPulse, NOROBOT, Phishing, Windows Persistence
Executive Summary
Russian state-sponsored cyber espionage operators continue to rapidly iterate their tradecraft to outmaneuver enterprise endpoint defenses. On September 29, 2026, Microsoft Threat Intelligence, alongside reporting from The Hacker News and CyberScoop, published an exhaustive threat report exposing a sweeping offensive campaign by Star Blizzard (also known as SEABORGIUM, COLDRIVER, or Callisto Group). Attributed by U.S. and U.K. intelligence agencies to Centre 18 of the Russian Federal Security Service (FSB), Star Blizzard has systematically evolved its tactics throughout 2026.
Moving away from labor-intensive, multi-step social engineering schemes such as ClickFix, Star Blizzard has transitioned to large-scale, high-velocity phishing campaigns. These operations utilize accounts registered on compromised third-party websites to distribute fraudulent event invitations—such as lures for the "Chatham House London Conference 2026" and a high-level summit on the Ukrainian crisis.
Central to this new offensive is the RedFlick technique, a low-friction persistence mechanism that installs malicious Windows Scheduled Tasks. These tasks execute Control Panel applet DLLs (downloaders known as NOROBOT or BAITSWITCH), which establish a customized embedded Python runtime to decode and launch the CosmicPulse (YESROBOT) backdoor. Microsoft confirmed that this refined delivery pipeline has impacted more than 100 organizations across the United States, the United Kingdom, and Ukraine, focusing primarily on defense contractors, international think tanks, NGOs, and diplomatic entities.
Technical Deep-Dive: Deconstructing the RedFlick and CosmicPulse Infection Pipeline
To understand how Star Blizzard achieves stealthy, persistent code execution, we trace the full infection lifecycle from initial email delivery to the execution of the Python-based backdoor.
STAR BLIZZARD (FSB CENTRE 18) REDFLICK ATTACK FLOW
1. Delivery: Victim receives high-fidelity event invite email sent via accounts on compromised websites (e.g., "Chatham House Conference 2026").
2. Trigger: Victim opens malicious lure attachment, triggering a single-interaction execution flow on the target endpoint.
3. RedFlick Persistence: Registers a recurring Windows Scheduled Task that invokes a Control Panel applet DLL (.cpl downloader / NOROBOT).
4. Staging Request: Downloader dispatches HTTPS GET requests to C2 infrastructure to pull two ZIP archives (Python 3.8 runtime + payload).
5. Environment Setup: Extracts standalone Python 3.8 environment and writes an encrypted AES key to HKCU\Software\Classes\.mollis.
6. CosmicPulse Bootstrapper: Python script reads .mollis, recovers the key via internal AES-ECB, and decrypts the main CosmicPulse binary in memory.
7. C2 Establishment: Establishes an encrypted Command-and-Control communications loop with actor infrastructure.
8. Exfiltration: Executes automated discovery and exfiltrates stored credentials, browser sessions, and sensitive files.
1. Initial Access Evolution: Compromised Legitimate Accounts
Historically, Star Blizzard engaged prospective targets through prolonged conversational grooming—often exchanging multiple benign emails from free webmail accounts (e.g., Proton Mail or Gmail) before sharing a credential-harvesting link or ClickFix payload:
* Mass Phishing Transition: In 2026, the group scaled up its operational tempo. Instead of free webmail, Star Blizzard compromises legitimate web applications, creates authorized sender accounts, and blasts high-fidelity invitations to hundreds of relevant stakeholders simultaneously.
* Topical Diplomatic Lures: Phishing emails impersonated prestigious international policy summits, including invitations to the "Chatham House London Conference 2026" and the "MAMA Summit on the Current Situation Surrounding the Ukrainian Crisis." Other lures included fake accounting notifications such as "Payment Advice Note from 06.08.2026" targeted at international financial institutions.
2. The RedFlick Persistence Technique
Earlier campaigns required victims to follow multi-step instructions (such as pressing Win+R and executing base64-encoded PowerShell strings). RedFlick streamlines this into a single interaction:
* Scheduled Task Registration: The lure initiates a Windows Scheduled Task designed to persist across system reboots and execute under standard user privileges.
* Control Panel Applet Execution: Rather than invoking standard script hosts like cscript.exe or powershell.exe (which frequently trigger behavioral EDR alarms), the task launches a Control Panel applet (.cpl extension) operating as a native dynamic link library (.dll).
3. The Multi-Stage Downloader (NOROBOT / BAITSWITCH)
The Control Panel applet functions as a modular downloader:
* Registry Artifact Staging: Upon execution, the downloader establishes a registry key under HKEY_CURRENT_USER\Software\Classes\.mollis, populating it with an encrypted cryptographic blob.
* Dual ZIP Ingestion: The loader issues HTTPS requests to remote actor-controlled staging servers, pulling two ZIP archives into temporary directories on disk:
1. Archive 1 (Python Environment): Contains a complete, self-contained Python 3.8 64-bit embedded distribution along with a launcher script (CosmicPulse bootstrapper).
2. Archive 2 (Encrypted Payload): Contains the obfuscated CosmicPulse backdoor code (internally tracked as YESROBOT).
4. Bootstrapping and In-Memory Execution of CosmicPulse
By bundling an authentic Python runtime, Star Blizzard avoids relying on pre-installed scripting engines:
* Key Recovery: The Python bootstrapper reads the encrypted data from the .mollis registry key. Utilizing a hardcoded master key, it decrypts the AES key via AES-ECB mode.
* Payload Unpacking: Armed with the recovered key, the bootstrapper decrypts the YESROBOT payload in memory and executes the backdoor logic without writing the unencrypted Python script to disk.
* Core Functionality: CosmicPulse provides comprehensive post-compromise capabilities: automated discovery of network shares, harvesting of browser credentials and session tokens, process injection, and encrypted command routing back to Russian intelligence infrastructure.
Industry Impact & Geopolitical Targeting
The targets observed in Star Blizzard’s recent waves reflect Russia’s strategic foreign policy intelligence priorities:
* Over 100 Impacted Entities: Telemetry confirms sustained targeting across the United States, the United Kingdom, and Ukraine.
* Think Tanks & Foreign Policy NGOs: Analysts and fellows shaping Western policy toward Eastern Europe and transatlantic security remain under intense surveillance.
* Financial Institutions Supporting Ukraine: Financial organizations facilitating aid, sanctions compliance monitoring, and economic reconstruction programs have been specifically singled out.
Defensive Hardening & Threat Hunting Blueprint
Security teams defending high-risk personnel and enterprise networks must implement proactive detection and hardening rules:
1. Hunt for Suspicious Scheduled Tasks & Control Panel Applets
* Process Creation Monitoring (Sysmon Event ID 1 / Windows Security 4688): Monitor command lines where control.exe or rundll32.exe loads .cpl files originating from user-writable directories (e.g., C:\Users\*\AppData\Local\Temp\ or C:\Users\Public\).
* Scheduled Task Auditing (Event ID 4698): Audit newly registered scheduled tasks executing binaries or applets outside C:\Windows\System32\.
2. Inspect Registry for Odd Extension Keys
Query the registry for the specific persistence and key-storage artifacts utilized by Star Blizzard:Get-ItemProperty -Path "HKCU:\Software\Classes\.mollis" -ErrorAction SilentlyContinue
Flag any endpoints where .mollis contains binary or base64-encoded values.
3. Detect Embedded Python Execution
* Alert on unsigned or standalone python.exe or pythonw.exe binaries executing from user profile directories (AppData\Local, Temp, or Downloads).
* Monitor network sockets created by Python processes on endpoints where Python is not an approved developer tool.
4. Enforce Phishing-Resistant MFA & Conditional Access
* Mandate FIDO2/WebAuthn hardware security keys to prevent session hijacking and adversary-in-the-middle (AiTM) proxy credential theft.
* Restrict access to corporate cloud resources using device-compliance and trusted-IP Conditional Access policies.
________________
For in-depth threat intelligence reports, nation-state malware teardowns, and enterprise detection engineering guides, subscribe to Digital Spying.