Loading story…
Russian state-linked Star Blizzard (also tracked as COLDRIVER) expanded its espionage phishing activity between January and August 2026, targeting more than 100 organizations, principally in the United States and United Kingdom. Targets included Ukrainian individuals and institutions, governments, NGOs, think tanks, financial organizations, academics, media, and diplomatic entities involved in Ukraine policy or support. The actor abused compromised cPanel- and WordPress-hosted sites to create sender accounts, then sent password-protected archives to recipients who engaged with initial lures.
Microsoft identified the actor’s RedFlick technique as a low-interaction delivery chain that uses VHDX/LNK files, MSI packages, Control Panel applets, PowerShell, and scheduled tasks to deploy the Python-based CosmicPulse backdoor. Persistence tasks impersonate network components, beacon host details, enable WebDAV remote execution, and retrieve a CosmicPulse downloader; July activity also hid Base64-encoded PowerShell payloads in PDFs. This development follows COLDRIVER’s 2025 rollout of the obfuscated PowerShell backdoor MAYBEROBOT (also called SIMPLEFIX), which replaced the Python-dependent YESROBOT and supported remote command execution and payload retrieval, indicating continued investment in adaptable malware delivery and evasion.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
A mid-August 2026 Star Blizzard campaign used steganography to conceal identifiers and sent unique ZIP attachments to individual targets.
In July 2026, Star Blizzard used nested password-protected RAR-in-ZIP archives containing an LNK that downloaded a PDF from actor infrastructure. The PDF concealed a Base64-encoded PowerShell command intended to download and install another MSI file.
By April 2026, RedFlick MSI installers created scheduled tasks named Internet Quality Test Connection, Network Configuration Manager, and System Health Monitor. The tasks supported host reconnaissance, WebDAV-enabled remote resource access, and retrieval and execution of next-stage payloads.
Beginning in March 2026, Star Blizzard expanded targeting beyond Ukraine, using purported conference and closed-door event invitations from think tanks or NGOs as lures. It also began using sender accounts created on compromised CPanel- and WordPress-hosted websites, shifting toward campaigns that sent tens to hundreds of messages.
In mid-January 2026, Star Blizzard sent password-protected ZIP archives containing malicious VHDX files. The VHDX chain used a disguised LNK, BAT script, conhost.exe, SSH with PermitLocalCommand, and an MSI installer to create scheduled tasks and deploy the CosmicPulse/NOROBOT downloader.
Beginning in January 2026, Star Blizzard conducted large-scale phishing campaigns, initially using tax-audit and fine-payment lures impersonating Ukrainian authorities against Ukr.net users. Microsoft reported at least 13 campaigns from January onward.
From June through September 2025, COLDRIVER iterated on NOROBOT and its delivery chain, rotating infrastructure and changing file names, paths, DLL names, exports, cryptographic-key collection, and intermediate stages to evade detection. The final MAYBEROBOT backdoor remained unchanged during these delivery-chain changes.
In early June 2025, Google Threat Intelligence Group observed COLDRIVER delivering a simplified NOROBOT downloader that established logon-script persistence and downloaded the PowerShell backdoor MAYBEROBOT, also known as SIMPLEFIX. GTIG assessed MAYBEROBOT was intended to replace the Python-dependent YESROBOT backdoor.
Google added identified COLDRIVER-related malicious websites, domains, and files to Safe Browsing and sent government-backed attacker alerts to targeted Gmail and Workspace users.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourcecloud.google.com
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Russian state-linked advanced persistent threat group COLDRIVER, also known as Star Blizzard, Callisto, and UNC4057, has expanded its cyber-espionage toolkit by launching a new campaign utilizing novel malware payloads. In this operation, COLDRIVER has introduced the BAITSWITCH and SIMPLEFIX payloads, which are delivered through a ClickFix-like campaign targeting individuals and organizations associated with civil society, NGOs, human rights defenders, and think tanks, particularly those with connections to Russia or residing in Western regions. The campaign employs malicious CAPTCHA checks to deceive victims into executing the BAITSWITCH DLL via the Windows Run dialog box. Once executed, BAITSWITCH retrieves the SIMPLEFIX payload, which enables the execution of PowerShell scripts, commands, and remote binaries hosted on external URLs, thereby granting attackers significant control over compromised systems. Security researchers from Zscaler ThreatLabz have highlighted that this campaign closely aligns with COLDRIVER’s established victimology, focusing on entities critical of or exiled from Russia. The use of these new malware strains demonstrates COLDRIVER’s ongoing efforts to update and diversify its attack arsenal, making detection and mitigation more challenging for defenders. The campaign’s technical sophistication is evident in its use of social engineering tactics, such as fake CAPTCHA prompts, to bypass user suspicion and security controls. The deployment of BAITSWITCH and SIMPLEFIX represents a notable evolution from previous COLDRIVER operations, which relied on more traditional phishing and malware delivery methods. The campaign’s infrastructure allows for flexible payload delivery, enabling attackers to adapt their tactics based on the target’s environment. Security analysts have warned that the campaign’s focus on civil society organizations increases the risk of sensitive information theft and potential disruption of advocacy activities. The operation’s timing coincides with heightened geopolitical tensions, further raising concerns about the potential for state-sponsored cyber-espionage to influence international affairs. Defensive recommendations include heightened vigilance for suspicious CAPTCHA prompts, monitoring for unusual DLL executions, and restricting PowerShell and remote binary execution where possible. The campaign underscores the persistent threat posed by Russian APT groups to Western civil society and the need for robust security awareness and technical controls. Organizations are advised to review their security postures and update detection mechanisms to identify the new BAITSWITCH and SIMPLEFIX payloads. The ongoing evolution of COLDRIVER’s tactics highlights the importance of continuous threat intelligence sharing and collaboration among targeted sectors. Security vendors and researchers continue to monitor the campaign for further developments and potential expansion of targeting. The incident serves as a reminder of the sophisticated and adaptive nature of state-linked cyber-espionage operations.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026