New LOSTKEYS Malware Tied to Russian State-Sponsored Hacker Group COLDRIVER

According to GTIG researchers and supporting analysis from Zscaler, a Russian state-sponsored threat actor COLDRIVER, long known for targeting NGOs, policy advisors and dissidents, has been linked to a rapidly evolving malware campaign following the public disclosure of its LOSTKEYS malware in May 2025; COLDRIVER is also tracked as UNC4057, Star Blizzard, and Callisto, and claims about the linkage are expressed as claims.

In the wake of the disclosure, COLDRIVER pivoted away from LOSTKEYS and, within five days, began deploying a diverse toolset of interconnected malware families, including NOROBOT, a malicious DLL delivered through an updated ClickFix lure that impersonates a CAPTCHA to prompt user interaction.

NOROBOT is designed to fetch additional stages from hardcoded C2 servers, with early variants leading to a Python backdoor called YESROBOT before MAYBEROBOT (also known as SIMPLEFIX) supplanted it, enabling a PowerShell-based backdoor and a more versatile command protocol.

The campaign emphasises evading detection by rotating infrastructure and tweaking infection chains, while Google’s Safe Browsing and threat notifications are being used to counter the activity, and defenders are urged to review IOCS and YARA rules to stay ahead.