Google reveals COLDRIVER’s new malware families NOROBOT, YESROBOT, and MAYBEROBOT amid rising cyber espionage.

Google reveals COLDRIVER’s new malware families NOROBOT, YESROBOT, and MAYBEROBOT amid rising cyber espionage.

The Russian state-backed Star Blizzard hacker group has ramped up operations with new, constantly evolving malware families (NoRobot, MaybeRobot) deployed in complex delivery chains that start with Cl...

The Russian state-backed Star Blizzard hacker group has ramped up operations with new, constantly evolving malware families (NoRobot, MaybeRobot) deployed in complex delivery chains that start with ClickFix...

The Russian state-backed Star Blizzard hacker group has ramped up operations with new, constantly evolving malware families (NoRobot, MaybeRobot) deployed in complex delivery chains that start with ClickFix social engineering attacks.

The Russian state-backed Star Blizzard hacker group has ramped up operations with new, constantly evolving malware families (NoRobot, MaybeRobot) deployed in complex delivery chains that start with…

The Russian state-backed Star Blizzard hacker group has ramped up operations with new, constantly evolving malware families (NoRobot, MaybeRobot) deployed in complex delivery chains that start with Cl...

The Russian state-backed Star Blizzard hacker group has ramped up operations with new, constantly evolving malware families (NoRobot, MaybeRobot) deployed in complex delivery chains that start with ClickFix social engineering attacks. [...]

O Grupo de Inteligência de Ameaças do Google (GTIG) identificou uma nova e acelerada onda de desenvolvimento de malwares atribuída ao COLDRIVER — um grupo de hackers associado ao governo russo. A descoberta foi detalhada em uma publicação feita nesta segunda-feira (20), revelando o surgimento de três novas ameaças cibernéticas: NOROBOT, YESROBOT e MAYBEROBOT. De acordo com o Google, a **nova família de malwares passou por “múltiplas iterações” desde maio deste ano** , o que demonstra um ritmo acelerado de evolução e operação por parte do COLDRIVER. As variantes descobertas compartilham uma cadeia de distribuição interligada, sugerindo um esforço coordenado de aprimoramento técnico e escalabilidade. A instalação do malware acontece por meio do método ClickFix. (Fonte: Google/Reprodução) Tradicionalmente conhecido por empregar ataques de phishing para comprometer alvos e roubar dados sensíveis, o COLDRIVER parece agora expandir seu escopo. “Está claro que eles investiram esforços significativos em seu desenvolvimento para reequipar e implantar seu malware em alvos específicos”, afirmou o GTIG. O **grupo acredita que os novos malwares sejam usados para infectar vítimas previamente comprometidas** , cujos dados e contatos foram extraídos em campanhas anteriores. O COLDRIVER — **também identificado pelos nomes UNC4057, Star Blizzard e Callisto** — é patrocinado pelo Estado russo e costuma mirar indivíduos de alto perfil, como consultores políticos, dissidentes e integrantes de ONGs. O avanço observado nos últimos meses coincide com a descoberta do malware LOSTKEYS, revelado em maio, o que reforça a hipótese de uma nova fase de atuação do grupo. ## Como acontece a infecção? A infecção ocorre a partir de um anúncio falso chamado ClickFix, disfarçado sob o nome COLDCOPY. Ao clicar no aviso, o usuário inicia o download do malware NOROBOT, executado por meio do processo legítimo `rundll32.exe`. Esse arquivo, por sua vez, aciona o próximo estágio da cadeia de ataque. Em versões iniciais, o NOROBOT distribuía o backdoor YESROBOT. Nas iterações mais recentes, no entanto, o COLDRIVER substituiu o payload pelo MAYBEROBOT — uma versão mais avançada e versátil, capaz de baixar cargas a partir de URLs específicos, executar comandos via CMD e rodar códigos diretamente no PowerShell. Os **malwares NOROBOT e MAYBEROBOT também são monitorados pela empresa de cibersegurança Zscaler** **ThreatLabz** , mas com os nomes BAITSWITCH e SIMPLESFIX, respectivamente. ## Google alertou vítimas sobre a atividade irregular O Google segue monitorando a evolução da família de malwares, destacando a rapidez com que o COLDRIVER adaptou e expandiu suas ferramentas ofensivas em poucos meses. Como medida de contenção, todas as páginas, os domínios e os arquivos maliciosos encontrados durante a investigação foram adicionados à lista de restrição do Safe Browsing. Alvos antigos e potenciais vítimas também foram alertados. Quer saber mais sobre cibersegurança e ameaças digitais? Acompanhe o **TecMundo** para se manter atualizado sobre as mais recentes descobertas, vulnerabilidades e estratégias de proteção no mundo da tecnologia.

Daily Recap, a roundup of recent cybersecurity activity highlights macOS ClickFix delivering Infiniti Stealer via a Nuitka loader, iOS exploitation by TA446 using DarkSword to deploy GHOSTBLADE and MAYBEROBOT, and backdoored Telnyx PyPI packages pushed by TeamPCP that use WAV steganography to exfiltrate SSH keys and tokens. The report also covers critical advisories (CVE-2026-3055, CVE-2025-53521), the Open VSX Open Sesame fix, major breaches including the European Commission cloud incident and Handala's alleged exfiltration of FBI director materials, plus governance moves such as the CSAM ruling, UK donation limits, the Chip Security Act, and OpenAI's Bug Bounty program. #InfinitiStealer #DarkSword #GHOSTBLADE #MAYBEROBOT #TeamPCP #Telnyx #NetScaler #CVE2026-3055 #CVE2025-53521 #EuropeanCommission #AnimePlay #Handala #OpenAI #Bugcrowd #OpenVSX #CSAMRuling #ChipSecurityAct

Proofpoint disclosed a targeted email campaign by Russia-linked TA446 that used the leaked DarkSword iOS exploit kit to target iPhones and iPads. The attacks spoofed the Atlantic Council, delivered the GHOSTBLADE dataminer and MAYBEROBOT backdoor, and prompted Apple to send Lock Screen warnings as DarkSword code leaked on GitHub. #TA446 #DarkSword...

Russian APT group COLDRIVER (UNC4057) quickly deployed new malware families, NOROBOT and MAYBEROBOT, after its LOSTKEYS tool was publicly disclosed, targeting high-value individuals.

The Russian state-backed Star Blizzard hacker group has ramped up operations with new, constantly evolving malware families (NoRobot, MaybeRobot) deployed in complex delivery chains that start with Cl...

Google reveals COLDRIVER’s new malware families NOROBOT, YESROBOT, and MAYBEROBOT amid rising cyber espionage.

The Russian state-backed Star Blizzard hacker group has ramped up operations with new, constantly evolving malware families (NoRobot, MaybeRobot) deployed in complex delivery chains that start with ClickFix social engineering attacks. [...]

In a chilling development in cyber espionage, Russia-linked hacking group COLDRIVER has advanced its malware capabilities, moving from its earlier NOROBOT backdoor to YESROBOT and now the latest variant, MAYBEROBOT. This evolution highlights a growing focus on NGOs, policy advisors, and dissident communities, marking a dangerous escalation in targeted cyber operations against civil society actors. Security analysts have traced multiple domains, IP addresses, and email-linked WHOIS records connected to these attacks, signaling a sophisticated infrastructure supporting the campaign.

Introduction Since May 2025, the Russia-linked cyberespionage group COLDRIVER has rapidly intensified its malware development, following the exposure of its LOSTKEYS malware. Known for targeting government officials, military personnel, journalists, and think tanks, COLDRIVER has been operating under aliases such as Seaborgium, UNC4057, Callisto, Star Blizzard, and TA446 since at least 2015. Recent intelligence from Google’s Threat Intelligence Group (GTIG) highlights a sharp acceleration in the group’s operational tempo and technical sophistication, signaling a new phase of aggressive cyberespionage activity.

In a striking demonstration of adaptability and persistence, the Russian state-sponsored hacking group known as ColdRiver has swiftly evolved its malware arsenal following the public exposure of its previous tool, LOSTKEYS, in May 2025. Within just five days of the disclosure, ColdRiver deployed a new suite of malware families—NOROBOT, YESROBOT, and MAYBEROBOT—marking a significant shift in their cyber espionage tactics. These developments underscore the group's commitment to maintaining operational continuity and enhancing the sophistication of their cyber operations.

The Hidden Cyber War Intensifies In the quiet hours of global networks, a silent battlefield is taking shape. Russian state-sponsored hacking group COLDRIVER, also known as Star Blizzard, has resurfaced with a new and more sophisticated arsenal of malware — a clear escalation in the ongoing digital cold war. The group, long associated with cyber espionage against Western institutions, has reportedly replaced its previous malware suite “LOSTKEYS” with three new tools: NOROBOT, YESROBOT, and MAYBEROBOT.