New COLDRIVER Malware Campaign Joins BO Team and Bearlyfy in Russia-Focused Cyberattacks

The Hacker News reports a fresh COLDRIVER campaign aimed at Russia, describing two new lightweight malware families, BAITSWITCH and SIMPLEFIX, delivered via a multi-stage ClickFix-style operation. According to Zscaler ThreatLabz, BAITSWITCH acts as a downloader that ultimately drops SIMPLEFIX, a PowerShell backdoor, with the adversary inducing user execution through a CAPTCHA-themed lure.

COLDRIVER, also known as Callisto, Star Blizzard and UNC4057, has targeted NGOs, human-rights defenders and civil society connected to Russia, and has expanded its toolset with components such as SPICA and LOSTKEYS. The campaign uses a Windows Run dialog trick to execute a malicious DLL that fetches a backdoor from attacker-controlled domains, exfiltrates system information and establishes persistence, then downloads a PowerShell stager to reach the SIMPLEFIX backdoor.

Separately, BO Team and Bearlyfy are highlighted for Russia-focused activity, with BO Team observed in early September using password-protected RARs to deliver a rewritten BrockenDoor and an updated ZeronetKit, while Bearlyfy has been linked to ransomware activity since January 2025 and claimed at least 30 victims by August 2025.

Bearlyfy is described as operating with a more immediate, targeted effect, and overlaps with a pro-Ukrainian group called PhantomCore in infrastructure, though Bearlyfy is considered autonomous.