Google Identifies Three New Russian Malware Families Created by COLDRIVER Hackers

Google Threat Intelligence Group (GTIG) has attributed new COLDRIVER operations to three malware families—NOROBOT, YESROBOT, and MAYBEROBOT—developed since May 2025, with an apparent rise in the threat actor’s tempo. GTIG notes the families form a delivery chain, evolving rapidly five days after LOSTKEYS was disclosed, and that NOROBOT and MAYBEROBOT are tracked by Zscaler ThreatLabz as BAITSWITCH and SIMPLEFIX.

The infection chain begins with an HTML ClickFix lure called COLDCOPY, designed to drop a DLL named NOROBOT, which is then executed via rundll32.exe to drop the next-stage malware; earlier versions distributed a Python backdoor named YESROBOT before MAYBEROBOT, a more flexible PowerShell-based implant, became prevalent.

YESROBOT uses HTTPS to retrieve commands from a hard-coded C2 server and can download and execute files as well as retrieve documents of interest, with two YESROBOT deployments observed in late May after LOSTKEYS details became public. MAYBEROBOT is considered more extensible, capable of downloading payloads from a URL, running commands via cmd.exe, and executing PowerShell code.

In a related matter, the Openbaar Ministerie in the Netherlands announced that three 17-year-old men are suspected of providing services to a foreign government, with one alleged to be in contact with a hacker group affiliated with the Russian government; two suspects were apprehended on 22 September 2025.