Russia-Linked COLDRIVER Group Expands Toolset, Using New Malware in ClickFix Espionage Campaign

The article reports that Zscaler ThreatLabz uncovered a new multi-stage ClickFix espionage campaign attributed with moderate confidence to the Russia-linked APT group COLDRIVER, also tracked as Star Blizzard, Callisto, and UNC4057. The campaign expands COLDRIVER’s toolset with two new malware families, a downloader named BAITSWITCH and a PowerShell-based backdoor called SIMPLEFIX, beginning with a ClickFix webpage masquerading as a resource for Russian civil society.

According to ThreatLabz, the page uses a ClickFix social-engineering method to trick users into executing a malicious command in the Windows Run dialog by displaying a fake Cloudflare Turnstile checkbox, after which the victim pastes the command into Run and machinerie.dll (BAITSWITCH) is executed via rundll32.exe.

BAITSWITCH serves as a downloader and persistence enabler, communicating with a C2 server at captchanom[.]top, and it retrieves stager payloads to trigger the SIMPLEFIX backdoor, which then can download and execute binaries, run reconnaissance commands, and exfiltrate documents from common directories. The campaign targets civil society actors, including human rights defenders, journalists, educators, and civic activists, continuing COLDRIVER’s focus on monitoring dissident communities. 29 September 2025.