Loading story…
The Russia-backed advanced persistent threat group ColdRiver, also known as UNC4057, Star Blizzard, and Callisto, has launched a new cyber espionage campaign targeting NATO governments, former diplomats, policy advisors, and high-profile NGO figures. Following the public disclosure of their LOSTKEYS credential-stealing malware by Google’s Threat Intelligence Group (GTIG) in May 2025, ColdRiver rapidly abandoned LOSTKEYS and pivoted to deploying a new suite of malware tools. Within five days of the LOSTKEYS exposure, the group had ceased all observed use of the platform and began leveraging new backdoors, including YESROBOT and MAYBEROBOT, distributed via a loader called NOROBOT. The initial infection vector in these campaigns involves a ClickFix CAPTCHA-style lure, which tricks users into executing a malicious file, thereby initiating the malware deployment process. The YESROBOT backdoor, written in Python, was first observed in late May 2025 and required a full Python 3.8 installation, with its decryption key split across multiple components as an anti-analysis measure. However, YESROBOT was considered cumbersome due to its operational requirements and limited extensibility. By early June 2025, ColdRiver had shifted to using MAYBEROBOT, a more streamlined PowerShell-based backdoor capable of downloading and executing content from a hardcoded command-and-control server, running commands via cmd.exe, and executing PowerShell blocks. The group continued to iterate on both NOROBOT and MAYBEROBOT throughout the summer, regularly rotating command-and-control infrastructure to evade detection. This rapid development and operational tempo highlight ColdRiver’s ability to adapt quickly when their tools are exposed. The campaigns demonstrate a shift from credential phishing without malware to the deployment of lightweight, modular backdoors, increasing the sophistication and persistence of their operations. Despite their technical agility, ColdRiver has experienced repeated operational security failures, which have allowed researchers to track their activities closely. The use of fake CAPTCHA lures and DLL execution via rundll32 marks a tactical evolution from previous PowerShell-based delivery methods. The group’s targets remain consistent, focusing on entities of strategic interest to Russian intelligence. GTIG’s ongoing monitoring has not observed any further use of LOSTKEYS since its exposure, confirming the group’s complete transition to the new malware suite. The campaigns underscore the importance of rapid threat intelligence sharing and the need for organizations to remain vigilant against evolving social engineering and malware delivery techniques. ColdRiver’s activities exemplify the persistent threat posed by state-sponsored actors capable of quickly retooling their operations in response to public disclosures. Organizations in the crosshairs of such groups should prioritize detection of novel malware loaders, backdoors, and social engineering lures, as well as maintain robust incident response capabilities.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
On October 21, 2025, Google Threat Intelligence Group disclosed three new COLDRIVER malware families—NOROBOT, YESROBOT, and MAYBEROBOT—and said the actor had increased its operational tempo since May 2025. Google also released indicators of compromise and YARA rules to help defenders detect the activity.
The Netherlands' Public Prosecution Service announced that three 17-year-old suspects were accused of providing services to a foreign government, including mapping Wi‑Fi networks in The Hague for possible espionage use. This development was reported alongside Google's findings on COLDRIVER but described as a separate case.
Later in the campaign, COLDRIVER swapped the short-lived YESROBOT implant for MAYBEROBOT, a more advanced PowerShell-based backdoor. Google assessed this reflected rapid malware iteration and a move toward a more capable follow-on implant.
In the earlier phase of the new toolchain, NOROBOT staged a Python 3.8 environment and delivered the YESROBOT backdoor. Google assessed YESROBOT was a short-lived interim implant used soon after the shift away from LOSTKEYS.
From June through September 2025, COLDRIVER used fake 'I am not a robot' CAPTCHA lures to trick targets into executing malicious commands via the Windows Run dialog. The delivery chain used COLDCOPY HTML lures to launch NOROBOT through rundll32.exe and establish follow-on access.
Within five days of Google's LOSTKEYS disclosure, COLDRIVER started deploying a new malware toolchain consisting of NOROBOT, YESROBOT, and later MAYBEROBOT. Google said it observed no further LOSTKEYS deployments after this pivot.
Google Threat Intelligence Group publicly reported on COLDRIVER's LOSTKEYS infostealer in May 2025. The disclosure exposed malware previously used against high-value targets including Western governments, journalists, think tanks, and NGOs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
10 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecsoonline.com
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourceaustinlarsen.me
Open sourcedarkreading.com
Open sourcescworld.com
Open sourceaustinlarsen.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Russian state-linked advanced persistent threat group COLDRIVER, also known as Star Blizzard, Callisto, and UNC4057, has expanded its cyber-espionage toolkit by launching a new campaign utilizing novel malware payloads. In this operation, COLDRIVER has introduced the BAITSWITCH and SIMPLEFIX payloads, which are delivered through a ClickFix-like campaign targeting individuals and organizations associated with civil society, NGOs, human rights defenders, and think tanks, particularly those with connections to Russia or residing in Western regions. The campaign employs malicious CAPTCHA checks to deceive victims into executing the BAITSWITCH DLL via the Windows Run dialog box. Once executed, BAITSWITCH retrieves the SIMPLEFIX payload, which enables the execution of PowerShell scripts, commands, and remote binaries hosted on external URLs, thereby granting attackers significant control over compromised systems. Security researchers from Zscaler ThreatLabz have highlighted that this campaign closely aligns with COLDRIVER’s established victimology, focusing on entities critical of or exiled from Russia. The use of these new malware strains demonstrates COLDRIVER’s ongoing efforts to update and diversify its attack arsenal, making detection and mitigation more challenging for defenders. The campaign’s technical sophistication is evident in its use of social engineering tactics, such as fake CAPTCHA prompts, to bypass user suspicion and security controls. The deployment of BAITSWITCH and SIMPLEFIX represents a notable evolution from previous COLDRIVER operations, which relied on more traditional phishing and malware delivery methods. The campaign’s infrastructure allows for flexible payload delivery, enabling attackers to adapt their tactics based on the target’s environment. Security analysts have warned that the campaign’s focus on civil society organizations increases the risk of sensitive information theft and potential disruption of advocacy activities. The operation’s timing coincides with heightened geopolitical tensions, further raising concerns about the potential for state-sponsored cyber-espionage to influence international affairs. Defensive recommendations include heightened vigilance for suspicious CAPTCHA prompts, monitoring for unusual DLL executions, and restricting PowerShell and remote binary execution where possible. The campaign underscores the persistent threat posed by Russian APT groups to Western civil society and the need for robust security awareness and technical controls. Organizations are advised to review their security postures and update detection mechanisms to identify the new BAITSWITCH and SIMPLEFIX payloads. The ongoing evolution of COLDRIVER’s tactics highlights the importance of continuous threat intelligence sharing and collaboration among targeted sectors. Security vendors and researchers continue to monitor the campaign for further developments and potential expansion of targeting. The incident serves as a reminder of the sophisticated and adaptive nature of state-linked cyber-espionage operations.
Jun 29, 2026
Several distinct malware and ransomware campaigns have resurfaced with new variants and advanced features, targeting organizations globally. The XWorm remote access trojan (RAT) has re-emerged in its version 6.0, now featuring a modular architecture that includes a ransomware plugin and advanced evasion techniques. This new version of XWorm is designed to bypass security defenses more effectively, increasing the risk of successful intrusions and data encryption. Meanwhile, the WARMCOOKIE malware has also returned after a previous takedown, now equipped with stealth handlers and utilizing expired command-and-control (C2) certificates to evade detection. The use of expired certificates is a novel tactic that complicates network monitoring and threat hunting efforts. In a separate development, the Russian-speaking Lunar Spider cybercriminal group has launched a new wave of ransomware attacks, leveraging the Latrodectus V2 loader to deliver their payloads. This loader is known for its sophisticated delivery mechanisms and ability to bypass traditional security controls. The Lunar Spider group’s campaign demonstrates a continued evolution in ransomware delivery, with a focus on maximizing infection rates and minimizing detection. Concurrently, ransomware groups Qilin and Gunra have been actively targeting South Korean organizations, with Qilin listing nine asset management firms and an engineering services company as victims, and Gunra compromising a gas manufacturing and supply company. These attacks highlight a trend of ransomware operators focusing on critical infrastructure and financial sectors in South Korea. The resurgence of these malware and ransomware families underscores the persistent threat posed by cybercriminal groups who continuously adapt their tools and techniques. Security researchers have observed that the modularity and stealth features in these new variants make them more challenging to detect and remediate. Organizations are advised to update their threat intelligence feeds and enhance monitoring for indicators of compromise associated with XWorm, WARMCOOKIE, and Latrodectus. The use of expired C2 certificates and advanced evasion tactics signals a shift in attacker methodologies, requiring defenders to adapt their detection strategies. The targeting of multiple sectors, including finance, engineering, and energy, demonstrates the broad scope of current ransomware campaigns. Incident response teams should be prepared for multi-stage attacks that leverage loaders like Latrodectus to deploy ransomware. The ongoing activity from groups such as Lunar Spider, Qilin, and Gunra indicates a high level of coordination and resourcefulness among threat actors. The rapid re-emergence of previously disrupted malware families suggests that takedown efforts may only provide temporary relief. Security teams should prioritize patching, network segmentation, and user awareness training to mitigate the risk of infection. Collaboration with threat intelligence providers can offer early warning of emerging threats and support proactive defense measures. The evolving landscape of ransomware and malware campaigns requires continuous vigilance and adaptation by defenders.
Jun 29, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026