Google says Russian espionage crew behind new malware campaign

News
By Sead Fadilpašić
published

COLDRIVER is stepping up its efforts against Ukrainian targets

Illustration of a laptop with a magnifying glass exposing a beetle on-screen
(Image credit: Shutterstock / Kanoktuch)

For more than a year now, Russian state-sponsored threat actors have been targeting Ukraine’s military and defense organizations with custom-made malware.

This is according to researchers from Google’s Threat Analysis Group (TAG), who dubbed the threat actors COLDRIVER - with other security teams tracking this group’s activity call them Star Blizzard, UNC4057 and Callisto.

According to TAG's report, COLDRIVER was observed back in 2019, going after military, government, academia, NGOs, and similar targets, in the West. However, since early 2022 and the beginning of the Russian invasion of Ukraine, the group stepped up its efforts by creating a brand new backdoor. This backdoor, called SPICA, can run shell commands, steal session cookies from the most popular browsers, upload and download files, view and exfiltrate sensitive documents.

Known distribution channels

"TAG has observed SPICA being used as early as September 2023, but believe that COLDRIVER's use of the backdoor goes back to at least November 2022," the TAG team said in its report published earlier this week. 

SPICA appears to be COLDRIVER’s first custom malware, and it’s being distributed to "high-profile individuals in NGOs, former intelligence and military officials, defense, and NATO governments," Google TAG's Billy Leonard told The Register.

The distribution method remains the same, though. The attackers would find out what they can about their victim on social media, and reach out by impersonating someone the victim knows. A separate report, published by Five Eyes, states the attackers use email to deliver a fake PDF that looks like an op-ed, but can’t be opened. Once the victim replies to the sender, the attackers return a “decryptor” for the file which, in reality, is the SPICA backdoor. 

The best way to defend against these attacks is to be extra careful with incoming email and to verify the sender’s identity before interacting with the message and its attachments.

More from TechRadar Pro

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.