Star Blizzard pivots to compromised WordPress infrastructure for RedFlick CosmicPulse delivery against 100+ targets

Microsoft documented 13 campaigns using hacked WordPress and cPanel accounts for C2, a shift from Proton and consumer Microsoft domains. The infection sequence begins with an LNK disguised as PDF that triggers an MSI installer creating three scheduled tasks mimicking network services. These tasks beacon system identifiers, establish WebDAV, and execute a Control Panel downloader that stages CosmicPulse. Earlier 2025 ClickFix CAPTCHA lures were replaced by this lower-interaction RedFlick method. Evidence shows the group first compromised infrastructure for email sending before weaponizing replies with RAR archives containing the LNK. One March campaign diverged by serving DarkSword iOS exploit kit to Atlantic Council-themed targets, indicating parallel capability testing. Technical artifacts overlap with prior FSB-linked operations but lack independent malware samples confirming Center 18 attribution beyond the Five Eyes joint statement. The move to compromised hosting and internal-looking lures reduces detection while scaling volume. This pattern matches procurement of FSB Center 18 for influence and collection operations against Ukraine-aligned entities. Official attribution rests on historical tradecraft rather than fresh telemetry linking specific domains to known FSB infrastructure. Next indicators will likely include expanded use of DarkSword or similar mobile vectors against iOS users in the same target set. Monitoring for new scheduled-task names and WebDAV C2 domains will surface follow-on activity within 60 days.