“Encrypted” lure-based malware delivery - COLDRIVER

FanJ · Jan 18, 2024

Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware
Google - Threat Analysis Group (TAG)
Jan 18, 2024
https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/

Over the years, TAG has analyzed a range of persistent threats including COLDRIVER (also known as UNC4057, Star Blizzard and Callisto), a Russian threat group focused on credential phishing activities against high profile individuals in NGOs, former intelligence and military officers, and NATO governments. For years, TAG has been countering and reporting on this group’s efforts to conduct espionage aligned with the interests of the Russian government. To add to the community’s understanding of COLDRIVER activity, we’re shining light on their extended capabilities which now includes the use of malware.
Click to expand...

As far back as November 2022, TAG has observed COLDRIVER sending targets benign PDF documents from impersonation accounts. COLDRIVER presents these documents as a new op-ed or other type of article that the impersonation account is looking to publish, asking for feedback from the target. When the user opens the benign PDF, the text appears encrypted.
Click to expand...

If the target responds that they cannot read the encrypted document, the COLDRIVER impersonation account responds with a link, usually hosted on a cloud storage site, to a “decryption” utility for the target to use. This decryption utility, while also displaying a decoy document, is in fact a backdoor, tracked as SPICA, giving COLDRIVER access to the victim’s machine.
Click to expand...

Long article. Read there more!!

Log in or Sign up

“Encrypted” lure-based malware delivery - COLDRIVER

FanJ Updates Team

Log in or Sign up

“Encrypted” lure-based malware delivery - COLDRIVER

FanJ Updates Team

Useful Searches