A Russian state-sponsored threat actor, known as Star Blizzard (also tracked as APT28), has adopted a new malware installation tactic dubbed “RedFlick” to streamline the deployment of its CosmicPulse backdoor. This evolution in tactics significantly automates initial access, reducing the need for extensive victim interaction compared to previous campaigns. Microsoft researchers have highlighted that Star Blizzard has expanded its phishing operations and refined its malware delivery mechanisms, impacting over 100 organizations, predominantly in the United States and the United Kingdom, as well as Ukrainian entities.
Technical Analysis of RedFlick and CosmicPulse
The RedFlick technique represents an optimization of Star Blizzard’s payload delivery, allowing for more efficient RedFlick CosmicPulse backdoor deployment. Attacks commence with a deceptive phishing email, often an invitation, followed by a second message containing a password-protected ZIP or RAR archive. This archive conceals a VHDX (Virtual Hard Disk) virtual disk that contains a malicious LNK shortcut file, cleverly disguised as a PDF document.
Upon a victim opening the LNK file, it triggers a command executed in a hidden window, while simultaneously displaying a decoy PDF to maintain the illusion of a legitimate document. This command initiates the download and execution of an MSI installer. The installer then establishes three distinct scheduled tasks, masquerading as routine system maintenance components. Each task serves a specific function within the infection chain, contributing to the attacker’s ability to evade detection by distributing malicious activities across multiple processes.
The next-stage payload, identified as NOROBOT and BAITSWITCH, is delivered as a Control Panel applet (.cpl) file. BAITSWITCH is responsible for fetching and executing the CosmicPulse backdoor. This involves downloading two ZIP archives; one contains a Python 3.8 64-bit package, and the other a Python file that functions as a bootstrapper for CosmicPulse. Microsoft details that “The bootstrapper reads the encrypted key from the registry, recovers it using an embedded key in AES-ECB mode, and then uses the recovered key to decode the CosmicPulse payload,” as reported by BleepingComputer. CosmicPulse’s capabilities, consistent with earlier observations, include the execution of attacker-supplied Python code, enabling the downloading and running of additional files, and the retrieval of sensitive documents from compromised systems.
Understanding Star Blizzard Phishing Techniques
Star Blizzard, active since 2017, consistently explores new avenues for payload delivery and develops new malware families. While RedFlick simplifies the victim interaction compared to previous methods like ClickFix, the core Star Blizzard phishing techniques remain consistent: impersonating trusted contacts or organizations and relying on free email providers to deliver initial phishing messages. Microsoft has observed at least 13 large-scale phishing campaigns utilizing RedFlick since the beginning of the year.
Impact and Targeted Sectors
The RedFlick campaigns have demonstrated a focused targeting strategy, primarily aimed at Ukrainian individuals and institutions. Beyond Ukraine, the actor has also targeted international NGOs, think tanks, governments, and financial institutions that have provided political or financial support to Ukraine. The confirmed compromise of over 100 organizations highlights the broad reach and significant impact of this evolving threat actor.
Actionable Recommendations for Mitigating Nation-State Phishing Attacks
To effectively counter the evolving tactics of Star Blizzard and similar nation-state actors, organizations must prioritize proactive security measures. Defenders seeking guidance on mitigating nation-state phishing attacks should focus on the following:
- Phishing-Resistant Authentication: Implement multi-factor authentication (MFA) methods that are inherently resistant to phishing, such as FIDO2 security keys or certificate-based authentication.
- Conditional Access Policies: Leverage Conditional Access to enforce strict requirements for accessing organizational resources, such as requiring trusted devices or specific network locations.
- Email Protection: Deploy advanced email protection solutions capable of detecting and blocking sophisticated phishing attempts, including those that use password-protected archives and disguised file types.
- Endpoint Detection and Response (EDR): Utilize EDR solutions configured in block mode. EDR can prevent the execution of malicious artifacts even if they bypass traditional antivirus detection.
- Independent Verification: Educate users to independently verify suspicious messages or attachments through established, out-of-band communication channels before opening any unfamiliar content.
By adopting these comprehensive security practices, organizations can significantly reduce their attack surface against highly persistent and adaptive threat actors like Star Blizzard.
Related: Zimbra Zero-Click Exploitation by Russian APT for Email Theft, APT28’s HOOKEDGE Backdoor Targets European Diplomacy