COLDRIVER APT Bounces Back: Deploys ‘ROBOT’ Malware Family Days After LOSTKEYS Exposure

COLDRIVER APT, a Russian state‑sponsored group also tracked as UNC4057, Star Blizzard and Callisto, has reportedly bounces back with a new ROBOT malware family just days after LOSTKEYS exposure. Within five days of the public disclosure of LOSTKEYS in May 2025, COLDRIVER began deploying NOROBOT, YESROBOT and MAYBEROBOT via an updated ClickFix lure masquerading as a CAPTCHA test.

According to Google Threat Intelligence, COLDRIVER swiftly shifted operations after the May 2025 disclosure, operationalising new malware families five days later, and GTIG notes that the ROBOT family has been used more aggressively than any previous campaigns attributed to COLDRIVER. The infection chain starts with a COLDCOPY “ClickFix” lure that downloads a DLL disguised as a CAPTCHA verification step, with NOROBOT first delivering a next payload from a hardcoded C2 server. Later MAYBEROBOT, a PowerShell‑based backdoor, provides stealthier persistence and greater flexibility, replacing YESROBOT as the campaign evolved.