What’s the RedFlick trick?

If you like horror stories where the twist is that you only needed to click one tiny thing, meet RedFlick. It’s a delivery mash-up used by the Russian state actor known as Star Blizzard to quietly install their long-lived backdoor, CosmicPulse, without making victims play a long, annoying game of “click this, then that.”

Here’s the short version: attackers send a two-part phishing setup. First, a social-message-style invite; second, a follow-up with a password-protected archive. Inside that archive is a virtual disk file containing a shortcut that looks like a PDF. When the victim opens the fake PDF, they see a legit-looking document while a hidden command runs in the background and pulls down an installer. From there, the infection chain pretty much runs itself.

The installer sets up multiple scheduled jobs — yep, the boring-sounding maintenance tasks are literal attack helpers — so the campaign splits responsibilities and becomes harder to spot at each stage.

  • Internet Quality Test Connection: reports machine and network names back to the attacker and can load remote DLLs.
  • Network Configuration Manager: configures WebDAV support so remote web resources act like files on disk.
  • System Health Monitor: uses a system control invocation to run the next-stage payload from a remote location.

Those three chores (the scheduled tasks) coordinate to fetch a downloader disguised as a Control Panel applet (.cpl). That downloader—known in reports as NOROBOT/BAITSWITCH—pulls down two ZIPs: one with a Python 3.8 runtime and one with a tiny Python bootstrapper. The bootstrapper grabs an encrypted key from the registry, recovers it using an embedded key via AES-ECB, and decrypts the real payload. That payload executes attacker-supplied Python code, which can fetch files, run programs, or harvest documents.

The evil beauty of RedFlick is automation: unlike older tricks that forced victims through several manual steps, here the user often only needs to open the malicious shortcut and the rest self-propagates.

Who’s being targeted and how to defend?

Star Blizzard has been active for years and keeps trying new delivery routes. Recent campaigns have hit organizations and individuals tied to Ukraine, international NGOs, think tanks, governments, and financial institutions—mostly in the United States and the United Kingdom—using free email accounts and social engineering to impersonate trusted contacts.

If you want to stop this particular circus, here are practical moves that actually help:

  • Use phishing-resistant authentication (hardware keys or modern multi-factor methods) instead of text-message codes.
  • Enforce conditional access policies to block risky logins and device states.
  • Harden email gateways and filter password-protected archives or at least quarantine them for inspection.
  • Verify suspicious messages out-of-band—call a known number or use a previously established channel.
  • Run endpoint detection and response (EDR) in block mode so malicious artifacts are stopped even if antivirus misses them.

Bottom line: this is a clever, automated delivery that relies on social engineering and a layered toolchain. The good news is standard hardening and a little skepticism from users go a long way—so train your people, tighten controls, and don’t be the person who opens that “PDF” shortcut without a tiny bit of paranoia.