COLDRIVER APT Group Uses ClickFix to Deliver New PowerShell-Based Backdoor BAITSWITCH

In a report dated 25 September 2025, the COLDRIVER APT group, also known as Star Blizzard, Callisto, and UNC4057, is observed expanding its arsenal with a multi‑stage ClickFix campaign to deliver two new families: a downloader called BAITSWITCH and a PowerShell-based backdoor named SIMPLEFIX, according to Zscaler ThreatLabz.

The operation targets Russian civil society, including human rights defenders, with the attackers masquerading as an information resource and using a fake Cloudflare Turnstile checkbox to prompt malicious actions. BAITSWITCH (machinerie.dll) establishes persistence by modifying the UserInitMprLogonScript registry key, stores encrypted payloads in EnthusiastMod and QatItems, and downloads a PowerShell stager from southprovesolutions[.]com, before erasing traces via RunMRU cleanup.

SIMPLEFIX runs in memory, uses registry-based persistence, and cycles every three minutes to exfiltrate data and receive commands, including reconnaissance and targeted file extensions. The campaign’s victimology, threat techniques, and use of lightweight, fileless malware reflect COLDRIVER’s evolving approach to cyber operations against civil society. According to Zscaler ThreatLabz.