Star Blizzard Trades Hand-Crafted Phish for Bulk Mail and VHDX Traps

Star Blizzard, the Russian espionage crew that Five Eyes governments tie to the FSB, has swapped its slow, hand-built phishing for bulk campaigns and a new delivery trick, according to a new CYFIRMA profile of the group. Drawing mostly on Microsoft’s Sept. 29 report, CYFIRMA counts at least 13 large campaigns against more than 100 organizations this year, mostly in the US and UK. The group also used a leaked iPhone exploit kit for the first time in March.

cyrna[.]top, byveo[.]org, guach[.]net, etia[.]ca, groy[.]cc, muvb[.]net
secure-dns-hub[.]com, ruten[.]observer, qumel[.]link, drasw[.]club
103.245.231[.]248, 103.245.231[.]79, 103.160.59[.]97, 45.84.59[.]66

Scheduled tasks: “Internet Quality Test Connection”, “Network Configuration Manager”, “System Health Monitor”, “System health check”
HKCU\Software\Classes\.mollis

Source article: Adversary Unmasked: APT Profile – Star Blizzard
Publisher: CYFIRMA (no author named)
Published: October 28, 2026
URL: https://www.cyfirma.com/research/adversary-unmasked-apt-profile-star-blizzard/

Executive Summary

Star Blizzard is a Russian state espionage actor that Five Eyes governments assess is almost certainly subordinate to FSB Centre 18; it is tracked by Microsoft as Star Blizzard (formerly SEABORGIUM), by Google as COLDRIVER and UNC4057, by Proofpoint as TA446, and also reported as Callisto Group, BlueCharlie and TAG-53 (MITRE ATT&CK G1033). It runs long-term credential theft and data theft against people of political interest, chiefly in the UK and US, Ukraine and other NATO states, plus Russian opposition figures and exiles, and the UK also attributes hack-and-leak operations to it. CYFIRMA’s profile, which relies mainly on Microsoft’s September 29, 2026 exposure of the RedFlick delivery technique and the CosmicPulse backdoor, describes at least 13 large-scale campaigns against more than 100 organizations between January and August 2026, a shift from hand-crafted spear-phishing to bulk mailings of tens or hundreds of messages, some sent from compromised cPanel and WordPress mailboxes. The intrusion chain starts with impersonation and a benign first contact, followed by a password-protected archive or a ZIP holding a VHDX image containing an LNK disguised as a PDF; the LNK runs a command stage (through ssh.exe local-command options in January 2026, through a hidden conhost.exe spawning curl.exe in July 2026) that fetches an MSI or PowerShell installer from short-lived actor hosts, leading to the CosmicPulse (YESROBOT) Python backdoor and a downloader disguised as a Control Panel applet, persistence through scheduled tasks with system-health names, a key fragment stored under HKCU\Software\Classes\.mollis, and HTTPS command and control. In parallel the actor keeps stealing mailbox credentials and session cookies through adversary-in-the-middle phishing, abuses forwarding rules and linked WhatsApp devices, and in March 2026 delivered the leaked DarkSword iOS exploit kit with the GHOSTBLADE dataminer. The objective is access to the email and messages of policy, government, defense and civil-society targets. Hunt leads, false positive expectations, CYFIRMA’s published hunting queries and indicators are detailed below.

ATT&CK chain: Reconnaissance → Resource Development → Initial Access → Execution → Persistence → Defense Evasion → Credential Access → Collection → Command and Control

Hunt Lead Grid

Star Blizzard 2026 Infrastructure and Hash Sweep

CYFIRMA’s indicator table, which follows Microsoft’s September 29, 2026 reporting, lists the hosts that served each RedFlick wave: MSI installer hosts etia[.]ca (January 2026), groy[.]cc and muvb[.]net (February), matjk[.]click and bpdaersa[.]click (March), Itechx[.]tel (April, spelling as published by Microsoft) and cyrna[.]top (August); PowerShell installer hosts guach[.]net (June) and byveo[.]org (July); CosmicPulse downloader hosts ruten[.]observer (June to July), secure-dns-hub[.]com (July, still active at publication), qumel[.]link (July) and drasw[.]club (August); and CosmicPulse backdoor download hosts gliderrompercycl[.]com, divekickspolic[.]org and stuseamandesilt[.]org. Dated IP addresses are 103.245.231[.]248 (January), 2.57.241[.]246 and 89.125.209[.]168 (February), 103.245.231[.]79 (March), 45.84.59[.]66 (April) and 103.160.59[.]97 (July). The 2025 set adds COLDCOPY lure domains, NOROBOT delivery hosts inspectguarantee[.]org and captchanom[.]top, YESROBOT C2 system-healthadv[.]com at 85.239.52[.]32 and MAYBEROBOT C2 southprovesolutions[.]com. The detection logic is a retrospective match of these domains in DNS, proxy and TLS SNI logs, of the IPs in firewall and NetFlow logs inside the month each was reported, and of the SHA-256 values in the appendix against email-gateway attachment logs and EDR file telemetry.

Use DNS resolver logs, secure web gateway or proxy logs, firewall and NetFlow, email-gateway attachment hashes and EDR file events. Sweep back to January 2026, and to May 2025 for the older set, since mailbox access obtained through phishing can outlive the session by months. CYFIRMA warns that infrastructure rotated roughly monthly and the 2025 indicators are over a year old, so a clean result means little; the value is finding a past compromise. Do not block or alert on the IP addresses outside their dated windows, because short-lived VPS addresses get reassigned to unrelated customers. The archive hashes for the August 2026 “Payment Advice Note.zip” were unique per target, so hash matching will not catch new recipients; match the file name and the sender pattern instead. Any domain or hash hit on a mailbox or endpoint belonging to policy, government-relations or executive staff should go straight to incident response, with a password reset and session revocation for the affected account.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer) (our mapping), T1071.001 (Application Layer Protocol: Web Protocols) (mapping per source article)

Sources: “Adversary Unmasked: APT Profile – Star Blizzard”, CYFIRMA, Oct. 28, 2026, https://www.cyfirma.com/research/adversary-unmasked-apt-profile-star-blizzard/ (source article)

Scheduled Tasks With Star Blizzard System-Health Names

CYFIRMA reports that NOROBOT in 2025 and RedFlick in 2026 persisted through scheduled tasks named to look like operating-system housekeeping: “Internet Quality Test Connection”, “Network Configuration Manager”, “System Health Monitor” and “System health check”. The source does not say which task launches which payload, but its own hunting guidance pairs these with control.exe, rundll32.exe or Python launched from user profiles. The detection logic is a 90-day search for task-creation events with those names and for schtasks.exe command lines that create them, followed by a review of each task’s action and the account that created it. CYFIRMA’s published query for this lead is reproduced below (quotation marks normalized from the page’s typographic quotes so it runs; line breaks added before each pipe).

Use Defender XDR DeviceEvents and DeviceProcessEvents, or the equivalents in other EDRs, and Windows Security event 4698 or the TaskScheduler operational log where EDR is missing. Run it across all Windows endpoints, prioritizing laptops of staff who handle policy, government relations or external events. Allowlist by the signed binary the task launches and its install path, never by task name alone, since the names are generic enough that a monitoring product could use one. A matching task whose action points into %APPDATA%, %LOCALAPPDATA% or a WebDAV path is a confirmed hit; escalate it and pair it with the CosmicPulse registry and Python leads to scope the host.

let names = dynamic(["Internet Quality Test Connection", "Network Configuration Manager",  "System Health Monitor", "System health check"]);union  (DeviceEvents | where Timestamp > ago(90d) and ActionType == "ScheduledTaskCreated" | extend TaskName = tostring(parse_json(AdditionalFields).TaskName) | where TaskName has_any (names)),  (DeviceProcessEvents | where Timestamp > ago(90d) and FileName =~ "schtasks.exe" | where ProcessCommandLine has_any (names) | extend TaskName = extract(@'/tn\s+"?([^"/]+)', 1, ProcessCommandLine))
| project Timestamp, DeviceName, AccountName, ActionType, TaskName, ProcessCommandLine

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task); Defense Evasion → T1036.004 (Masquerading: Masquerade Task or Service) (mapping per source article)

Sources: “Adversary Unmasked: APT Profile – Star Blizzard”, CYFIRMA, Oct. 28, 2026, https://www.cyfirma.com/research/adversary-unmasked-apt-profile-star-blizzard/ (source article; query 3)

CosmicPulse .mollis Registry Key

According to CYFIRMA, the 2026 CosmicPulse downloader stores a fragment of its encryption key under HKCU\Software\Classes\.mollis, a made-up file-class key in the user hive. The source does not give the value name or data. The detection logic is any registry create, set or delete event on a key path containing Software\Classes\.mollis, with the initiating process recorded so the downloader can be located.

Use EDR registry telemetry or Sysmon event IDs 12 and 13, plus an offline sweep of NTUSER.DAT and UsrClass.dat hives across the fleet for the key, since a key written months ago will not appear in a 30-day event window. Sweep 90 days of events and every user profile on disk. The exact key is a near-zero-noise indicator for this tooling; the broader pattern of unknown file-class keys under HKCU\Software\Classes written by a script interpreter or a .cpl host carries over to other malware that hides configuration there. Do not delete the key on discovery; image the host first, because the key fragment can help decrypt captured traffic or payloads. Any hit is an escalation.

DeviceRegistryEvents
| where Timestamp > ago(90d)
| where RegistryKey has @"Software\Classes\.mollis"
| project Timestamp, DeviceName, ActionType, RegistryKey, InitiatingProcessFileName

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Defense Evasion → T1112 (Modify Registry) (mapping per source article)

Sources: “Adversary Unmasked: APT Profile – Star Blizzard”, CYFIRMA, Oct. 28, 2026, https://www.cyfirma.com/research/adversary-unmasked-apt-profile-star-blizzard/ (source article; query 6)

SSH LocalCommand Execution on Windows Workstations

In the January 2026 RedFlick wave, the LNK hidden in Documents.vhdx (delivered as Documents.zip) used the built-in Windows OpenSSH client to run a command on the local machine through the PermitLocalCommand and LocalCommand options, which turns ssh.exe into a proxy for launching the next stage. CYFIRMA does not publish the full command line. The detection logic is ssh.exe with both option names on its command line, with extra weight when the parent is explorer.exe, a shortcut target or a script host, and when the process starts from or references a mounted volume or the user’s Downloads or Temp folder.

Use EDR process telemetry on Windows endpoints; Windows 10 and 11 ship ssh.exe under C:\Windows\System32\OpenSSH\, so it is present almost everywhere. Sweep 30 days, and 90 if your retention allows, given the January date. Most office users never run ssh.exe at all, so scope first by host role and treat developer and administrator workstations separately, where LocalCommand may appear in legitimate configs but rarely on the command line. Blocking ssh.exe by hash would break legitimate administration; CYFIRMA’s mitigation is to block outbound SSH from workstations that don’t need it. Pair a hit with the infrastructure sweep and the LNK correlation lead before escalating, and escalate any hit on a non-technical user’s laptop immediately. The technique is not specific to this actor and generalizes to any abuse of OpenSSH options for local execution.

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "ssh.exe"
| where ProcessCommandLine has "PermitLocalCommand" and ProcessCommandLine has "LocalCommand"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1202 (Indirect Command Execution) (our mapping; the source lists this step under the RedFlick chain without an ATT&CK ID)

Sources: “Adversary Unmasked: APT Profile – Star Blizzard”, CYFIRMA, Oct. 28, 2026, https://www.cyfirma.com/research/adversary-unmasked-apt-profile-star-blizzard/ (source article; query 1)

Control Panel Applet Loaded From WebDAV or User Paths

CYFIRMA reports that the 2026 CosmicPulse downloader was disguised as a Control Panel applet and that payloads ran from WebDAV paths, while NOROBOT in 2025 was a DLL launched through rundll32.exe. When a .cpl file is opened, control.exe or rundll32.exe with Control_RunDLL loads it, so the code runs under a signed Windows binary. The detection logic is control.exe or rundll32.exe command lines referencing a .cpl or Control_RunDLL together with a UNC path, the WebDAV markers DavWWWRoot or @SSL, or a path under AppData or Temp.

Use EDR process and image-load telemetry, and add WebClient service start events and outbound WebDAV (HTTP PROPFIND) requests from the proxy where available to confirm the remote load. Sweep 30 days. Allowlist on the signed CPL path and publisher (vendor applets live under Program Files or System32), never on control.exe itself, which every Windows host runs. Disabling the WebClient service on workstations that don’t need it removes the WebDAV route entirely and is a better control than trying to block individual domains. A .cpl loaded over WebDAV from an external host is malicious until proven otherwise; escalate it and recover the applet from the host’s WebDAV client cache or the remote share before it rotates away. This lead generalizes to the many loaders that abuse CPL proxy execution.

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("control.exe", "rundll32.exe")
| where ProcessCommandLine has_any ("Control_RunDLL", ".cpl")
| where ProcessCommandLine contains @"\\" or ProcessCommandLine has_any ("DavWWWRoot", "@SSL", "AppData", "Temp")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1218.002 (System Binary Proxy Execution: Control Panel) (mapping per source article)

Sources: “Adversary Unmasked: APT Profile – Star Blizzard”, CYFIRMA, Oct. 28, 2026, https://www.cyfirma.com/research/adversary-unmasked-apt-profile-star-blizzard/ (source article; query 4)

Mailbox Forwarding Rules Created or Changed

The group’s end goal is the mailbox. CYFIRMA, citing the December 2023 Five Eyes advisory, says Star Blizzard created forwarding rules in compromised mailboxes, and it continues to steal credentials and session cookies through EvilGinx-style adversary-in-the-middle pages and replay them to read mail without re-authenticating. The detection logic is creation or modification of Microsoft 365 inbox rules that forward, redirect or forward-as-attachment, enriched with the source IP, the destination address and whether the sign-in that preceded it came from a new device or location.

Use Microsoft 365 unified audit logs or Defender for Cloud Apps CloudAppEvents, joined to Entra ID sign-in logs. Sweep 90 days, and further for high-risk users, because forwarding rules persist after passwords change and are the reason a reset alone doesn’t end an intrusion. Prioritize policy, government-relations, treasury and executive accounts and their assistants. Expect benign hits from users forwarding to their own personal accounts and from delegates; tune by excluding internal-only destinations and approved delegate setups rather than whole users. External forwarding created from an IP the account has never used is an escalation: remove the rule, revoke sessions, reset credentials and review mail access. Remember that personal webmail accounts of the same staff are also targeted and are outside this telemetry.

CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules")
| where RawEventData has_any ("ForwardTo", "RedirectTo", "ForwardAsAttachmentTo")
| project Timestamp, AccountDisplayName, IPAddress, ActionType, RawEventData

Hunt Lead Level: 2 (Pro)

ATT&CK: Collection → T1114.003 (Email Collection: Email Forwarding Rule) (mapping per source article); related: Credential Access → T1557 (Adversary-in-the-Middle), T1539 (Steal Web Session Cookie)

Sources: “Adversary Unmasked: APT Profile – Star Blizzard”, CYFIRMA, Oct. 28, 2026, https://www.cyfirma.com/research/adversary-unmasked-apt-profile-star-blizzard/ (source article; query 8)

VHDX or Archive LNK to Hidden Conhost, Curl and Python in AppData

The 2026 delivery runs in a recognizable sequence. A ZIP or password-protected RAR (conference invitation in June, roundtable invitation in July, “Payment Advice Note.zip” in August) or a VHDX image holds an LNK disguised as a PDF; mounting the VHDX means the LNK carries no Mark-of-the-Web. In the July 2026 variant the LNK starts a hidden conhost.exe, which spawns curl.exe to fetch the next stage, an MSI or PowerShell installer from hosts such as byveo[.]org, and the chain ends with the CosmicPulse Python backdoor running from the user’s AppData folder, launched by the scheduler, control.exe, rundll32.exe or cmd.exe. The detection logic correlates three events on one host within a short window: a VHDX mount or archive extraction followed by an LNK launch from that volume or folder; conhost.exe with curl.exe as its child, whose grandparent traces back to that LNK; and python.exe or pythonw.exe starting from \AppData\ with one of those parents. CYFIRMA’s two published queries for the second and third steps are reproduced below.

This needs EDR process telemetry plus disk-image mount events (from EDR, or the Windows VHDMP operational log) and proxy logs for the curl.exe download, joined in a SIEM. Run the sequence over 30 days with a window of an hour or so between steps, and keep the two single-source queries as standalone hunts. Baseline first: some software uses curl.exe from scripts and some users install Python per-user under AppData, so the single queries are noisy on developer machines, while the joined sequence is not. Blocking the mounting of VHD and VHDX files from email and downloads, and stripping LNKs from archives at the mail gateway, remove the first step and are the controls CYFIRMA recommends; blocking curl.exe or Python by hash would break legitimate tools. A completed sequence on any host is an escalation; isolate the host and collect the downloaded installer and the Python files before cleanup. The pattern (container file, LNK, LOLBin download, script runtime in the profile) fits many current phishing chains, not only this actor.

DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "conhost.exe" and FileName =~ "curl.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessParentFileName

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("python.exe", "pythonw.exe") and FolderPath has @"\AppData\"
| where InitiatingProcessFileName in~ ("svchost.exe", "control.exe", "rundll32.exe", "cmd.exe")
| summarize count(), make_set(ProcessCommandLine, 5) by DeviceName, FolderPath

Hunt Lead Level: 3 (Elite)

ATT&CK: Initial Access → T1566.001 (Phishing: Spearphishing Attachment); Defense Evasion → T1553.005 (Subvert Trust Controls: Mark-of-the-Web Bypass); Execution → T1204.002 (User Execution: Malicious File), T1059.006 (Command and Scripting Interpreter: Python) (mapping per source article); Command and Control → T1105 (Ingress Tool Transfer) (our mapping)

Sources: “Adversary Unmasked: APT Profile – Star Blizzard”, CYFIRMA, Oct. 28, 2026, https://www.cyfirma.com/research/adversary-unmasked-apt-profile-star-blizzard/ (source article; queries 2 and 7)

Hash Appendix

RedFlick lures and archives (2026)

SHA-256 values come from the source article; it gives no MD5 or SHA-1, and AlienVault OTX and VirusTotal were not queried in this run. The August 2026 archive was unique per target.

MD5s
(not available)  # all files

SHA1s
(not available)  # all files

SHA256s
9707a8694e954e9ee13e839d6e5905ce626c0837c7c90da6d1025bfbe152866b  # Documents.zip, RedFlick lure, Jan 2026
1f2096ff906915fbf80778f0636446206197351f7e271af97936eeb6f32c179d  # Documents.vhdx (inside Documents.zip), Jan 2026
699e92a9e0edf7835879d5697bc67138c0b137117f459caf1a44df357407cad9  # password-protected RAR, conference invitation lure, Jun 2026
24b6e36a09eb2acfc2a95478ca685acb7593b1689be6a4a639fe0d222393cfa7  # password-protected RAR, roundtable invitation lure, Jul 2026
dd98dbc1a55afe6fd0ed2ed53a79c76f6bde15081a0060422185b74eb1799ee4  # Payment Advice Note.zip, Aug 2026 (unique per target)

COLDCOPY, NOROBOT, YESROBOT and MAYBEROBOT (2025)

SHA-256 values come from the source article; no MD5 or SHA-1 given, and OTX and VirusTotal were not queried in this run.

MD5s
(not available)  # all files

SHA1s
(not available)  # all files

SHA256s
c4d0fba5aaafa40aef6836ed1414ae3eadc390e1969fdcb3b73c60fe7fb37897  # COLDCOPY fake-CAPTCHA lure, 2025
2e74f6bd9bf73131d3213399ed2f669ec5f75392de69edf8ce8196cd70eb6aee  # NOROBOT iamnotarobot.dll, May 2025
3b49904b68aedb6031318438ad2ff7be4bf9fd865339330495b177d5c4be69d1  # NOROBOT checkme.dll, Jun 2025
e9c8f6a7dba6e84a7226af89e988ae5e4364e2ff2973c72e14277c0f1462109b  # NOROBOT checkme.dll, Jun 2025
f2da013157c09aec9ceba1d4ac1472ed049833bc878a23bc82fe7eacbad399f4  # NOROBOT machinerie.dll, 2025
87138f63974a8ccbbf5840c31165f1a4bf92a954bacccfbf1e7e5525d750aa48  # NOROBOT machinerie.dll, Aug 2025
bce2a7165ceead4e3601e311c72743e0059ec2cd734ce7acf5cc9f7d8795ba0f  # YESROBOT Python backdoor
b60100729de2f468caf686638ad513fe28ce61590d2b0d8db85af9edc5da98f9  # MAYBEROBOT PowerShell backdoor, obfuscated

Note: ssh.exe, conhost.exe, curl.exe, control.exe, rundll32.exe and the Python runtime abused in this chain are legitimate binaries; do not block their hashes. Detect the command lines, paths and parentage instead.

References Appendix

• “Adversary Unmasked: APT Profile – Star Blizzard”, CYFIRMA, Oct. 28, 2026, https://www.cyfirma.com/research/adversary-unmasked-apt-profile-star-blizzard/ (source article; aliases, 2026 chain, ATT&CK table, eight hunting queries, indicators, hashes)
• “Star Blizzard refines phishing and malware delivery with the RedFlick technique”, Microsoft Threat Intelligence, Sept. 29, 2026, https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/ (primary reporting cited by the source article for RedFlick and CosmicPulse)
• MITRE ATT&CK, Star Blizzard, G1033, https://attack.mitre.org/groups/G1033/, and the technique pages linked above