Russian state actor Star Blizzard has deployed a new malware delivery technique called RedFlick to distribute its CosmicPulse backdoor. The method uses phishing emails with password-protected archives containing virtual disks that, when opened, automatically download and execute malware through scheduled tasks. Since early 2026, Microsoft has observed at least 13 large-scale campaigns targeting over 100 organizations, primarily in the US and UK, with focus on Ukrainian entities and international organizations supporting Ukraine.