Google Identifies New Malware Linked to Russian Hacker Group COLDRIVER

Google has recently identified a new strain of malware named "LOSTKEYS," attributed to the Russian hacking group COLDRIVER. This malware is designed to steal sensitive files and transmit critical system data back to its operators, marking a significant escalation in the group's cyber capabilities.

Key Takeaways

• New Malware: The malware, dubbed "LOSTKEYS," is a sophisticated tool for espionage.

• Targeted Entities: COLDRIVER has been targeting Western government officials, journalists, and NGOs.

• Historical Context: The group has a history of cyber operations linked to Russian geopolitical interests.

• Security Measures: Google has implemented protective measures to mitigate the risks associated with this malware.

Overview of COLDRIVER

COLDRIVER, also known by various aliases, is a Russian-aligned hacking group believed to have connections with the Federal Security Service (FSB). Historically, the group has focused on credential phishing, targeting high-profile individuals within NATO governments, NGOs, and former intelligence officials. Their primary objective is to gather intelligence that aligns with Russian strategic interests.

Areas of activity

Monitoring by Google’s Threat Intelligence Group (GTIG) has shown that since January 2024, COLDRIVER has expanded its targets to include:

• Current and former advisors to Western governments and military institutions.

• Journalists and members of international think tanks.

• Non-governmental organizations and individuals associated with Ukraine.

Historical Context of Cold River's Operations

COLDRIVER has previously been implicated in several high-profile cyber operations, including:

• Targeting three nuclear research facilities in the United States in mid-2022.

• Leaking private emails of former British intelligence chief Sir Richard Dearlove and other pro-Brexit individuals.

These operations highlight the group's ongoing commitment to espionage and intelligence gathering.

The Emergence of LOSTKEYS

The introduction of LOSTKEYS represents a notable advancement in COLDRIVER's toolkit. According to Wesley Shields, a researcher at GTIG, this malware is capable of:

• Stealing files from various directories and extensions.

• Sending system information and running processes back to the attackers.

The malware is delivered through a multi-step process that includes:

1. Lure Website: A fake CAPTCHA is presented to the target.

2. PowerShell Script: This script is downloaded to the user's clipboard.

3. Device Evasion: The malware employs techniques to evade detection.

4. Final Payload Retrieval: The malware is installed on the target's system.

LOSTKEYS payload delivery: Google

Google’s Response and Recommendations

In light of the discovery of LOSTKEYS, Google has taken proactive measures to protect users, including:

• Adding identified malicious websites to its Safe Browsing feature.

• Sending alerts to targeted Gmail and Workspace users about potential threats.

• Encouraging users to enable Enhanced Safe Browsing and keep their devices updated.

Cybersecurity analysts emphasize the importance of vigilance among organizations and individuals who may be at risk from COLDRIVER's evolving tactics. The emergence of LOSTKEYS underscores a broader trend of increasing sophistication in cyber espionage tactics employed by state-linked actors.

As the landscape of cyber threats continues to evolve, it is crucial for potential targets to adopt robust security measures to safeguard their sensitive information.

Sources

• Google uncovers ‘LOSTKEYS’ malware linked to Russian-backed Cold River hackers, Mint.

• Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware, Google Blog.

• Google uncovers new malware linked to Russian hacking group Cold River, Dimsum Daily.

• Google identifies new malware linked to Russia-based hacking group, Reuters.

• COLDRIVER using new malware to steal from Western targets — Google, Cointelegraph.

This article was created with support from AI-driven technology, drawing on multiple reputable sources. The final content has been thoroughly reviewed and edited by BlockzHub's editorial team to ensure accuracy, clarity, and coherence. Original reporting sources are credited whenever appropriate and as required. The opinions expressed in this article do not necessarily represent the official views or positions of BlockzHub. This article is intended for informational purposes only and should not be considered financial or professional advice. Investing involves risk, and you should consult a qualified financial advisor before making any investment decisions.