Loading story…
The Russian state-linked advanced persistent threat group COLDRIVER, also known as Star Blizzard, Callisto, and UNC4057, has expanded its cyber-espionage toolkit by launching a new campaign utilizing novel malware payloads. In this operation, COLDRIVER has introduced the BAITSWITCH and SIMPLEFIX payloads, which are delivered through a ClickFix-like campaign targeting individuals and organizations associated with civil society, NGOs, human rights defenders, and think tanks, particularly those with connections to Russia or residing in Western regions. The campaign employs malicious CAPTCHA checks to deceive victims into executing the BAITSWITCH DLL via the Windows Run dialog box. Once executed, BAITSWITCH retrieves the SIMPLEFIX payload, which enables the execution of PowerShell scripts, commands, and remote binaries hosted on external URLs, thereby granting attackers significant control over compromised systems. Security researchers from Zscaler ThreatLabz have highlighted that this campaign closely aligns with COLDRIVER’s established victimology, focusing on entities critical of or exiled from Russia. The use of these new malware strains demonstrates COLDRIVER’s ongoing efforts to update and diversify its attack arsenal, making detection and mitigation more challenging for defenders. The campaign’s technical sophistication is evident in its use of social engineering tactics, such as fake CAPTCHA prompts, to bypass user suspicion and security controls. The deployment of BAITSWITCH and SIMPLEFIX represents a notable evolution from previous COLDRIVER operations, which relied on more traditional phishing and malware delivery methods. The campaign’s infrastructure allows for flexible payload delivery, enabling attackers to adapt their tactics based on the target’s environment. Security analysts have warned that the campaign’s focus on civil society organizations increases the risk of sensitive information theft and potential disruption of advocacy activities. The operation’s timing coincides with heightened geopolitical tensions, further raising concerns about the potential for state-sponsored cyber-espionage to influence international affairs. Defensive recommendations include heightened vigilance for suspicious CAPTCHA prompts, monitoring for unusual DLL executions, and restricting PowerShell and remote binary execution where possible. The campaign underscores the persistent threat posed by Russian APT groups to Western civil society and the need for robust security awareness and technical controls. Organizations are advised to review their security postures and update detection mechanisms to identify the new BAITSWITCH and SIMPLEFIX payloads. The ongoing evolution of COLDRIVER’s tactics highlights the importance of continuous threat intelligence sharing and collaboration among targeted sectors. Security vendors and researchers continue to monitor the campaign for further developments and potential expansion of targeting. The incident serves as a reminder of the sophisticated and adaptive nature of state-linked cyber-espionage operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
SC Media separately reported the same development: COLDRIVER had updated its attack arsenal with new malware, while noting concurrent pro-Ukrainian hacking activity targeting Russia. This reflects the same underlying campaign evolution rather than a separate incident.
Google disclosed that the Russia-linked COLDRIVER espionage group expanded its toolset by deploying new malware through ClickFix-style lures. The reporting identified this as a new development in the group's attack arsenal and campaign tradecraft.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citizen Lab and Access Now documented a sophisticated spear-phishing campaign targeting Russian opposition figures, Belarusian and Russian civil society groups, independent media, international NGOs active in Eastern Europe, policy experts, funders, journalists, and at least one former U.S. ambassador. Researchers attributed one cluster to **COLDRIVER**—also tracked as **Star Blizzard**, **Callisto**, **TA446**, **Blue Charlie**, and **UNC4057**—a Russia-linked threat actor that multiple governments have associated with the FSB’s Centre 18, while identifying a separate but related phishing cluster as **COLDWASTREL**. The operations used highly personalized impersonation emails sent from compromised or lookalike accounts, along with fake encrypted or protected PDF lures that redirected victims through fingerprinting infrastructure to credential-harvesting pages spoofing services such as Gmail and ProtonMail. Investigators found overlaps with known COLDRIVER tradecraft, including Hostinger-registered domains, Let’s Encrypt or ZeroSSL certificates, LibreOffice 7.0 PDF metadata, randomized author names, and occasional HubSpot links, while COLDWASTREL showed distinct metadata, infrastructure, and domain patterns. The groups sought passwords, two-factor authentication codes, and session cookies, raising the risk of exposing sensitive identities, communications, relationships, and locations of organizations already facing Russian government repression.
Jul 12, 2026
The Russia-backed advanced persistent threat group ColdRiver, also known as UNC4057, Star Blizzard, and Callisto, has launched a new cyber espionage campaign targeting NATO governments, former diplomats, policy advisors, and high-profile NGO figures. Following the public disclosure of their LOSTKEYS credential-stealing malware by Google’s Threat Intelligence Group (GTIG) in May 2025, ColdRiver rapidly abandoned LOSTKEYS and pivoted to deploying a new suite of malware tools. Within five days of the LOSTKEYS exposure, the group had ceased all observed use of the platform and began leveraging new backdoors, including YESROBOT and MAYBEROBOT, distributed via a loader called NOROBOT. The initial infection vector in these campaigns involves a ClickFix CAPTCHA-style lure, which tricks users into executing a malicious file, thereby initiating the malware deployment process. The YESROBOT backdoor, written in Python, was first observed in late May 2025 and required a full Python 3.8 installation, with its decryption key split across multiple components as an anti-analysis measure. However, YESROBOT was considered cumbersome due to its operational requirements and limited extensibility. By early June 2025, ColdRiver had shifted to using MAYBEROBOT, a more streamlined PowerShell-based backdoor capable of downloading and executing content from a hardcoded command-and-control server, running commands via cmd.exe, and executing PowerShell blocks. The group continued to iterate on both NOROBOT and MAYBEROBOT throughout the summer, regularly rotating command-and-control infrastructure to evade detection. This rapid development and operational tempo highlight ColdRiver’s ability to adapt quickly when their tools are exposed. The campaigns demonstrate a shift from credential phishing without malware to the deployment of lightweight, modular backdoors, increasing the sophistication and persistence of their operations. Despite their technical agility, ColdRiver has experienced repeated operational security failures, which have allowed researchers to track their activities closely. The use of fake CAPTCHA lures and DLL execution via rundll32 marks a tactical evolution from previous PowerShell-based delivery methods. The group’s targets remain consistent, focusing on entities of strategic interest to Russian intelligence. GTIG’s ongoing monitoring has not observed any further use of LOSTKEYS since its exposure, confirming the group’s complete transition to the new malware suite. The campaigns underscore the importance of rapid threat intelligence sharing and the need for organizations to remain vigilant against evolving social engineering and malware delivery techniques. ColdRiver’s activities exemplify the persistent threat posed by state-sponsored actors capable of quickly retooling their operations in response to public disclosures. Organizations in the crosshairs of such groups should prioritize detection of novel malware loaders, backdoors, and social engineering lures, as well as maintain robust incident response capabilities.
Jun 29, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026