The Russian superior persistent risk (APT) group often called COLDRIVER has been attributed to a recent spherical of ClickFix-style assaults designed to ship two new “light-weight” malware households tracked as BAITSWITCH and SIMPLEFIX.
Zscaler ThreatLabz, which detected the brand new multi-stage ClickFix marketing campaign earlier this month, described BAITSWITCH as a downloader that finally drops SIMPLEFIX, a PowerShell backdoor.
COLDRIVER, additionally tracked as Callisto, Star Blizzard, and UNC4057, is the moniker assigned to a Russia-linked risk actor that is identified to focus on a variety of sectors since 2019. Whereas early marketing campaign waves had been noticed utilizing spear-phishing lures to direct targets to credential harvesting pages, the group has been fleshing out its arsenal with customized instruments like SPICA and LOSTKEYS, which underscores its technical sophistication.
The adversary’s use of ClickFix techniques was beforehand documented by the Google Risk Intelligence Group (GTIG) again in Might 2025, utilizing faux websites serving faux CAPTCHA verification prompts to trick the sufferer into executing a PowerShell command that is designed to ship the LOSTKEYS Visible Primary Script.
“The continued use of ClickFix means that it’s an efficient an infection vector, even whether it is neither novel nor technically superior,” Zscaler safety researchers Sudeep Singh and Yin Hong Chang stated in a report revealed this week.
The newest assault chain follows the identical modus operandi, tricking unsuspecting customers into operating a malicious DLL within the Home windows Run dialog below the guise of finishing a CAPTCHA test. The DLL, BAITSWITCH, reaches out to an attacker-controlled area (“captchanom[.]high”) to fetch the SIMPLEFIX backdoor, whereas a decoy doc hosted on Google Drive is offered to the victims.
It additionally makes a number of HTTP requests to the identical server to ship system info, obtain instructions to ascertain persistence, retailer encrypted payloads within the Home windows Registry, obtain a PowerShell stager, clear the latest command executed within the Run dialog, successfully erasing traces of the ClickFix assault that triggered the an infection.
The downloaded PowerShell stager subsequently reaches out to an exterior server (“southprovesolutions[.]com”) to obtain SIMPLEFIX, which, in flip, establishes communication with a command-and-control (C2) server to run PowerShell scripts, instructions, and binaries hosted on distant URLs.
One of many PowerShell scripts executed by way of SIMPLEFIX exfiltrates details about a hard-coded checklist of file sorts present in a pre-configured checklist of directories. The checklist of directories and file extensions scanned shares overlaps with that of LOSTKEYS.
“The COLDRIVER APT group is understood for focusing on members of NGOs, human proper defenders, suppose tanks in Western areas, in addition to people exiled from and residing in Russia,” Zscaler stated. “The main target of this marketing campaign intently aligns with their victimology, which targets members of civil society related to Russia.”
BO Crew and Bearlyfy Goal Russia
The event comes as Kaspersky stated it noticed a brand new phishing marketing campaign focusing on Russian corporations in early September undertaken by the BO Crew group (aka Black Owl, Hoody Hyena, and Lifting Zmiy) utilizing password-protected RAR archives to ship a brand new model of BrockenDoor rewritten in C# and an up to date model of ZeronetKit.
A Golang backdoor, ZeronetKit, comes fitted with capabilities to assist distant entry to compromised hosts, add/obtain information, execute instructions utilizing cmd.exe, and create a TCP/IPv4 tunnel. Choose newer variations additionally incorporate assist for downloading and operating shellcode, in addition to replace the communication interval with C2 and modify the C2 server checklist.
“ZeronetKit is unable to independently persist on an contaminated system, so attackers use BrockenDoor to repeat the downloaded backdoor to startup,” the Russian cybersecurity vendor stated.
It additionally follows the emergence of a brand new group referred to as Bearlyfy that has used ransomware strains like LockBit 3.0 and Babuk in assaults focusing on Russia, initially attacking smaller corporations for smaller ransoms earlier than graduating to larger corporations within the nation beginning April 2025, in accordance with F6. As of August 2025, the group is estimated to have claimed no less than 30 victims.
In a single incident focusing on a consulting firm, the risk actors have been noticed weaponizing a susceptible model of Bitrix for preliminary entry, adopted by utilizing the Zerologon flaw to escalate privileges. In one other case noticed in July, the preliminary entry is alleged to have been facilitated by an unnamed companion firm.
“In the latest recorded assault, the attackers demanded €80,000 in cryptocurrency, whereas within the first assault, the ransom was a number of thousand {dollars},” F6 researchers stated. “Because of the comparatively low ransom quantities, on common, each fifth sufferer buys decryptors from the attackers.”
Bearlyfy is assessed to be lively since January 2025, with a deeper evaluation of its instruments uncovering infrastructure overlaps with a possible pro-Ukrainian risk group referred to as PhantomCore, which has a observe file of focusing on Russian and Belarusian corporations since 2022. Regardless of these similarities, Bearlyfy is believed to be an autonomous entity.
“PhantomCore implements advanced, multi-stage assaults typical of APT campaigns,” the corporate stated. “Bearlyfy, however, makes use of a distinct mannequin: assaults with minimal preparation and a focused give attention to attaining a right away impact. Preliminary entry is achieved by exploitation of exterior providers and susceptible functions. The first toolkit is geared toward encryption, destruction, or modification of information.”
