Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Google says Russian espionage crew behind new malware campaign

Illustration of a laptop with a magnifying glass exposing a beetle on-screen.

For more than a year now, Russian state-sponsored threat actors have been targeting Ukraine’s military and defense organizations with custom-made malware.

This is according to researchers from Google’s Threat Analysis Group (TAG), who dubbed the threat actors COLDRIVER - with other security teams tracking this group’s activity call them Star Blizzard, UNC4057 and Callisto.

According to TAG's report, COLDRIVER was observed back in 2019, going after military, government, academia, NGOs, and similar targets, in the West. However, since early 2022 and the beginning of the Russian invasion of Ukraine, the group stepped up its efforts by creating a brand new backdoor. This backdoor, called SPICA, can run shell commands, steal session cookies from the most popular browsers, upload and download files, view and exfiltrate sensitive documents.

Known distribution channels

"TAG has observed SPICA being used as early as September 2023, but believe that COLDRIVER's use of the backdoor goes back to at least November 2022," the TAG team said in its report published earlier this week. 

SPICA appears to be COLDRIVER’s first custom malware, and it’s being distributed to "high-profile individuals in NGOs, former intelligence and military officials, defense, and NATO governments," Google TAG's Billy Leonard told The Register.

The distribution method remains the same, though. The attackers would find out what they can about their victim on social media, and reach out by impersonating someone the victim knows. A separate report, published by Five Eyes, states the attackers use email to deliver a fake PDF that looks like an op-ed, but can’t be opened. Once the victim replies to the sender, the attackers return a “decryptor” for the file which, in reality, is the SPICA backdoor. 

The best way to defend against these attacks is to be extra careful with incoming email and to verify the sender’s identity before interacting with the message and its attachments.

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.