New COLDRIVER Malware Campaign Joins BO Team and Bearlyfy in Russia-Focused Cyberattacks
ClickFix-style assaults targeting two new "lightweight" malware families known as BAITSWITCH and SIMPLEFIX have been linked to the Russian advanced persistent threat (APT) group COLDRIVER.
The new multi-stage ClickFix campaign was discovered earlier this month by Zscaler ThreatLabz, which characterized BAITSWITCH as a downloader that eventually installs SIMPLEFIX, a PowerShell backdoor.
Since 2019, a Russian-affiliated threat actor known as COLDRIVER—also known as Callisto, Star Blizzard, and UNC4057—has been reported to attack a variety of industries. The gang has been expanding its toolkit with unique tools like SPICA and LOSTKEYS, which highlights its technological sophistication, even if early campaign waves were seen employing spear-phishing lures to guide targets to credential...