Russia-linked COLDRIVER speeds up malware evolution after LOSTKEYS exposure

The article reports that the Russia-linked APT COLDRIVER has rapidly upgraded its malware since May 2025, following exposure of its LOSTKEYS variant. According to Google Threat Intelligence Group, the group has been rolling out frequent updates, refining tools and accelerating development across the operation.

The campaign shifted from an initial NOROBOT backdoor delivered via a COLDCOPY “ClickFix” lure disguised as a CAPTCHA to newer, streamlined payloads that avoid PowerShell-based infections by prompting users to run a DLL via rundll32. Early NOROBOT variants used a Python backdoor called YESROBOT, but from June operators introduced a leaner MAYBEROBOT, delivering a single logon-script payload that installs a heavily obfuscated PowerShell backdoor.

NOROBOT’s delivery chain evolved to include rotated infrastructure, changed file and DLL names, and multi-stage steps, with cryptographic keys reintroduced in later variants to hinder analysis. The report notes that MAYBEROBOT became the more observable final backdoor, while COLDRIVER continues to balance stealth and deployability and to pursue persistent access on high-value targets.