The Russian superior persistent risk (APT) group generally known as COLDRIVER has been attributed to a contemporary spherical of ClickFix-style assaults designed to ship two new “light-weight” malware households tracked as BAITSWITCH and SIMPLEFIX.
Zscaler ThreatLabz, which detected the brand new multi-stage ClickFix marketing campaign earlier this month, described BAITSWITCH as a downloader that finally drops SIMPLEFIX, a PowerShell backdoor.
COLDRIVER, additionally tracked as Callisto, Star Blizzard, and UNC4057, is the moniker assigned to a Russia-linked risk actor that is recognized to focus on a variety of sectors since 2019. Whereas early marketing campaign waves had been noticed utilizing spear-phishing lures to direct targets to credential harvesting pages, the group has been fleshing out its arsenal with customized instruments like SPICA and LOSTKEYS, which underscores its technical sophistication.
The adversary’s use of ClickFix techniques was beforehand documented by the Google Risk Intelligence Group (GTIG) again in Could 2025, utilizing pretend websites serving pretend CAPTCHA verification prompts to trick the sufferer into executing a PowerShell command that is designed to ship the LOSTKEYS Visible Fundamental Script.
“The continued use of ClickFix means that it’s an efficient an infection vector, even whether it is neither novel nor technically superior,” Zscaler security researchers Sudeep Singh and Yin Hong Chang mentioned in a report revealed this week.
The newest assault chain follows the identical modus operandi, tricking unsuspecting customers into working a malicious DLL within the Home windows Run dialog below the guise of finishing a CAPTCHA verify. The DLL, BAITSWITCH, reaches out to an attacker-controlled area (“captchanom[.]prime”) to fetch the SIMPLEFIX backdoor, whereas a decoy doc hosted on Google Drive is offered to the victims.
It additionally makes a number of HTTP requests to the identical server to ship system data, obtain instructions to ascertain persistence, retailer encrypted payloads within the Home windows Registry, obtain a PowerShell stager, clear the newest command executed within the Run dialog, successfully erasing traces of the ClickFix assault that triggered the an infection.
The downloaded PowerShell stager subsequently reaches out to an exterior server (“southprovesolutions[.]com”) to obtain SIMPLEFIX, which, in flip, establishes communication with a command-and-control (C2) server to run PowerShell scripts, instructions, and binaries hosted on distant URLs.
One of many PowerShell scripts executed by way of SIMPLEFIX exfiltrates details about a hard-coded listing of file sorts present in a pre-configured listing of directories. The listing of directories and file extensions scanned shares overlaps with that of LOSTKEYS.
“The COLDRIVER APT group is understood for focusing on members of NGOs, human proper defenders, assume tanks in Western areas, in addition to people exiled from and residing in Russia,” Zscaler mentioned. “The main focus of this marketing campaign carefully aligns with their victimology, which targets members of civil society linked to Russia.”
BO Workforce and Bearlyfy Goal Russia
The event comes as Kaspersky mentioned it noticed a brand new phishing marketing campaign focusing on Russian corporations in early September undertaken by the BO Workforce group (aka Black Owl, Hoody Hyena, and Lifting Zmiy) utilizing password-protected RAR archives to ship a brand new model of BrockenDoor rewritten in C# and an up to date model of ZeronetKit.
A Golang backdoor, ZeronetKit, comes fitted with capabilities to help distant entry to compromised hosts, add/obtain information, execute instructions utilizing cmd.exe, and create a TCP/IPv4 tunnel. Choose newer variations additionally incorporate help for downloading and working shellcode, in addition to replace the communication interval with C2 and modify the C2 server listing.
“ZeronetKit is unable to independently persist on an contaminated system, so attackers use BrockenDoor to repeat the downloaded backdoor to startup,” the Russian cybersecurity vendor mentioned.
It additionally follows the emergence of a brand new group referred to as Bearlyfy that has used ransomware strains like LockBit 3.0 and Babuk in assaults focusing on Russia, initially attacking smaller corporations for smaller ransoms earlier than graduating to greater corporations within the nation beginning April 2025, in response to F6. As of August 2025, the group is estimated to have claimed a minimum of 30 victims.
In a single incident focusing on a consulting firm, the risk actors have been noticed weaponizing a weak model of Bitrix for preliminary entry, adopted by utilizing the Zerologon flaw to escalate privileges. In one other case noticed in July, the preliminary entry is alleged to have been facilitated by way of an unnamed companion firm.
“In the newest recorded assault, the attackers demanded €80,000 in cryptocurrency, whereas within the first assault, the ransom was a number of thousand {dollars},” F6 researchers mentioned. “As a result of comparatively low ransom quantities, on common, each fifth sufferer buys decryptors from the attackers.”
Bearlyfy is assessed to be energetic since January 2025, with a deeper evaluation of its instruments uncovering infrastructure overlaps with a possible pro-Ukrainian risk group referred to as PhantomCore, which has a monitor file of focusing on Russian and Belarusian corporations since 2022. Regardless of these similarities, Bearlyfy is believed to be an autonomous entity.
“PhantomCore implements advanced, multi-stage assaults typical of APT campaigns,” the corporate mentioned. “Bearlyfy, alternatively, makes use of a unique mannequin: assaults with minimal preparation and a focused concentrate on reaching a right away impact. Preliminary entry is achieved by way of exploitation of exterior companies and weak functions. The first toolkit is aimed toward encryption, destruction, or modification of information.”
