
← Back to Labs
← Volver a Labs
Medium
Campaign
Persistence
EDR, Sysmon, Windows
RedFlick: Star Blizzard's New Single-Click Delivery Chain for the CosmicPulse Backdoor
The CosmicPulse delivery chain ends with an MSI installer that establishes persistence by creating three scheduled tasks disguised as legitimate Windows or network maintenance components. Each task handles a distinct step of the infection, ultimately deploying a custom backdoor



