ColdRiver Drops Fresh Malware on Targets

A sweeping cyber espionage campaign attributed to a Russia-linked group shows how quickly elite hacking teams can pivot when exposed, with NATO governments, former diplomats, and high-profile NGO figures targeted.

In May this year, according to Google Threat Intelligence Group (GTIG), details of LOSTKEYS, a sophisticated malware platform linked to ColdRiver, were published, and within five days ColdRiver scrapped LOSTKEYS and rolled out an entirely new toolset in a campaign GTIG researcher Wesley Shields described as the group’s most aggressive yet.

The threat actor, also known as UNC4057, Star Blizzard and Callisto, originally used phishing and credential theft to gain access but shifted to deploying lightweight malware via a CAPTCHA-style lure that tricks users into running a malicious file. GTIG notes the new toolkit centres on NOROBOT, an initial downloader that fetches the next stage payload, with NOROBOT variants splitting encryption keys to hinder analysis.

Earlier stages included NOFOBOT downloading YESROBOT, a Python-based backdoor, though it was later replaced by a PowerShell-based backdoor tracked as MAYBEROBOT for persistent remote control.