Russian APT Switches to New Backdoor After Malware Exposed by Researchers

The Russian state-sponsored APT Star Blizzard has shifted to a new backdoor after its LostKeys malware was detailed in a public report in June, according to Google. The group, also tracked as Callisto, ColdRiver, Seaborgium and UNC4057, began using the NoRobot (BaitSwitch) backdoor and the MaybeRobot (SimpleFix) family in attacks and never deployed LostKeys again.

They dropped the PowerShell infection chain and now rely on the victim’s execution of a malicious DLL via rundll32, with the DLL designed to fetch the next-stage payload and achieve persistence, Google says. The NoRobot backdoor previously included a Python backdoor called YesRobot, which was abandoned in favour of MaybeRobot, and MaybeRobot is deployed via NoRobot, Google notes.

Between May and September 2025, Star Blizzard made multiple changes to NoRobot to evade detection and updated its infection chain as it transitioned to deploying MaybeRobot as the final stage.