Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Russian government-backed threat group COLDRIVER has developed a new malware called LOSTKEYS, capable of stealing files and system information. The group targets high-profile individuals, NGOs, and former intelligence officers through credential phishing and malware delivery. LOSTKEYS is delivered through a multi-step infection chain, starting with a fake CAPTCHA and involving PowerShell commands. The malware evades detection in VMs and uses a substitution cipher for decoding. COLDRIVER's primary goal is intelligence collection for Russia's strategic interests, targeting Western governments, militaries, journalists, and Ukraine-related individuals. The group has been linked to hack-and-leak campaigns in the UK and against NGOs.

COLDRIVER is a Russian government-backed threat actor that has developed a new malware strain named LOSTKEYS, designed primarily for espionage and intelligence collection. LOSTKEYS targets Western governments, militaries, journalists, NGOs, and individuals connected to Ukraine, including former intelligence officers. The infection vector begins with credential phishing campaigns that lure victims into interacting with a fake CAPTCHA, initiating a multi-stage infection chain. This chain leverages PowerShell commands to deploy the malware payload. LOSTKEYS employs advanced evasion techniques such as detecting virtual machine environments to avoid sandbox analysis and uses a substitution cipher to decode its payload, complicating detection and analysis. The malware is capable of stealing documents and system information, facilitating the exfiltration of sensitive data. COLDRIVER’s operations have been linked to hack-and-leak campaigns in the UK and against NGOs, underscoring their focus on high-value intelligence targets. The malware’s tactics, techniques, and procedures (TTPs) include credential theft, document theft, use of PowerShell for execution, and network reconnaissance, aligning with MITRE ATT&CK techniques such as T1566 (Phishing), T1059.001 (PowerShell), T1005 (Data from Local System), and T1102 (Web Service). Despite the lack of known exploits in the wild, the threat is credible given the actor’s history and strategic targeting.

MD5 of e7b6bfbfb6e496e57ceaba00fabe7df1d6b5061c

MD5 of 94bfd6fba2dec53a4df9b815d1f7dc150b37d4af

MD5 of 0ac32fd4e6ef96163084fdb09d05e1ae7124e6d9

MD5 of 56b0d6d7fb81b77c0713361f0b95994d19414bf1

MD5 of bd907c2512facbeef31d4e683828dfece01849e2

MD5 of ff9824395c18e1cf70960862654eb0a8b012eeaa

MD5 of de2e039c69f6f4f5af23d4eac2d3235e2ce4f20c

SHA256 of ff9824395c18e1cf70960862654eb0a8b012eeaa

SHA256 of de2e039c69f6f4f5af23d4eac2d3235e2ce4f20c

SHA256 of bd907c2512facbeef31d4e683828dfece01849e2

SHA256 of 94bfd6fba2dec53a4df9b815d1f7dc150b37d4af

SHA256 of e7b6bfbfb6e496e57ceaba00fabe7df1d6b5061c

SHA256 of 0ac32fd4e6ef96163084fdb09d05e1ae7124e6d9

SHA256 of 56b0d6d7fb81b77c0713361f0b95994d19414bf1

Detailed information about COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs. Get real-time updates, technical details, and mitigatio

Title	Severity	Type	Source	Date

Threats Tagged 'document theft'

Filter Threats

Threats Tagged 'document theft'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility