To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER

COLDRIVER, a Russian state-sponsored threat group, swiftly shifted operations after their LOSTKEYS malware was exposed in May 2025. They developed new malware families, including NOROBOT, YESROBOT, and MAYBEROBOT, within days. The infection chain begins with a COLDCOPY lure disguised as a CAPTCHA, leading to the deployment of NOROBOT, a DLL that retrieves subsequent stages. YESROBOT, a Python backdoor, was briefly used before being replaced by MAYBEROBOT, a more flexible PowerShell backdoor. The malware chain has undergone constant evolution, with COLDRIVER focusing on evading detection while maintaining intelligence collection capabilities against high-value targets. The group's tactics include using HTTPS for command retrieval, encrypting commands, and implementing various evasion techniques.

• QuartzLine: A working PDF viewer with a backdoor insideMalware2026-10-16
• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• Kimsuky attacks targeting Ukrainian experts in diplomacy, security, and international policyCampaign2026-10-13
• August 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-02
• Star Blizzard refines phishing and malware delivery with the RedFlick techniqueMalware2026-09-30