COLDRIVER (UNC4057/Star Blizzard) Re-Tools with NOROBOT/BAITSWITCH/YESROBOT/MAYBEROBOT/SIMPLEFIX Malware Chain After LOSTKEYS Disclosure
COLDRIVER (UNC4057/Star Blizzard) Re-Tools with (TL-2026-1510), also tracked as Operation COLDCOPY, is a high-severity malware campaign, first published 2026-07-19. It is attributed to Cold River (Russia) with high confidence, affects Microsoft Windows (Run dialog / rundll32 / PowerShell / Task, maps to 31 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 54 indicators of compromise.
Key facts for TL-2026-1510
- Threat ID
- TL-2026-1510
- Also known as
- Operation COLDCOPY, NOROBOT Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-19
- Last reviewed
- 2026-07-19
- Attribution
- Cold River
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, non-profit organisation, think-tank, civil society, diplomatic, defense, news - media
- Target regions
- North America, Europe, united kingdom, russia, Ukraine-adjacent
- Detection rules
- 9
- Indicators of compromise
- 54
Malware and tooling in COLDRIVER (UNC4057/Star Blizzard) Re-Tools with
Malware and tooling: COLDCOPY, LOSTKEYS, MAYBEROBOT, NOROBOT, Spica - S1140, YESROBOT
Russian state-sponsored group COLDRIVER (aka UNC4057, Star Blizzard, Callisto) rapidly re-tooled within five days of its May 2025 LOSTKEYS disclosure, deploying a new ClickFix-style infection chain (COLDCOPY lure -> BAITSWITCH/NOROBOT DLL downloader -> YESROBOT or MAYBEROBOT/SIMPLEFIX backdoor) against NGOs, policy advisors, and Russian civil-society dissidents. GTIG assesses this as the most aggressively used COLDRIVER toolset to date, with continuous chain evolution from May through September 2025.
How COLDRIVER (UNC4057/Star Blizzard) Re-Tools with works
COLDRIVER (UNC4057/Star Blizzard/Callisto), a Russian FSB-linked state-sponsored intelligence-collection actor, operationalized an entirely new malware chain within five days of the public disclosure of its LOSTKEYS VBS stealer in May 2025. The new chain begins with a ClickFix social-engineering lure (internally COLDCOPY) presenting a fake Cloudflare Turnstile/CAPTCHA 'verify you are not a robot' page that instructs the victim to copy a command into the Windows Run dialog, executing `rundll32.exe` against a remotely-hosted DLL (`iamnotarobot.dll` / `checkme.dll` / `machinerie.dll`) exporting `humanCheck` or `verifyme`. This DLL downloader — tracked as NOROBOT by GTIG and independently as BAITSWITCH by Zscaler — establishes registry- and logon-script-based persistence, splits AES decryption keys across multiple registry values (`EnthusiastMode`, `QatItems`, and a custom `.pietas` class key) and multiple network fetches to frustrate single-artifact analysis, deletes `RunMRU` history to cover tracks, and retrieves a PowerShell stager that decrypts and loads a backdoor on next logon. Between May and early June 2025 the downloader delivered YESROBOT, a Python 3.8 backdoor requiring a bundled SFX Python interpreter install, HTTPS beaconing with base64-encoded system info in the User-Agent, AES-encrypted command retrieval, and execution restricted to raw Python code — assessed by GTIG as a hastily-built, noisy stopgap abandoned after only two observed victims. From June 2025 onward COLDRIVER shifted to MAYBEROBOT (SIMPLEFIX in Zscaler's naming), a heavily obfuscated PowerShell backdoor with a compact three-command custom HTTPS protocol (download-and-execute, cmd.exe command execution, PowerShell block execution) that avoids the Python dependency, beacons roughly every three minutes with hostname/username/machine-UUID identifiers, and remained functionally unchanged through the September 2025 observation window — indicating high operator confidence in its stability and evasion. The downloader itself continued to iterate: simplified in June 2025 to a single-fetch/single-persistence model, then deliberately re-complicated in late August 2025 with re-introduced key-splitting and multi-stage downloads, reflecting a deliberate operational-security trade-off between deployment speed and defender reconstruction difficulty. Targeting is consistent with COLDRIVER's long-running mission: NGOs, policy advisors, journalists, think tanks, former NATO/Western government and intelligence officials, and exiled members of Russian civil society (human rights defenders, educators, civic activists), often lured with decoy documents themed around resilience programs for exiled Russians. The chain is fully living-off-the-land and social-engineering driven — no CVE or software vulnerability is exploited; compromise depends entirely on the victim manually executing an attacker-supplied command. Google added all observed domains and hashes to Safe Browsing, issued government-backed-attacker warnings to targeted Gmail/Workspace users, and published YARA detection rules for NOROBOT, YESROBOT, and MAYBEROBOT. The rapid five-day re-tooling turnaround after the LOSTKEYS takedown, combined with a mature, unchanged backdoor and iterative downloader hardening over four months, indicates pre-built contingency tooling and sustained resourcing consistent with an FSB-directed persistent-access mission against Western and Russian-diaspora targets.
MITRE ATT&CK techniques used in TL-2026-1510
Collection
T1005 Data from Local System; T1119 Automated Collection
Discovery
T1016 System Network Configuration Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1120 Peripheral Device Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1070.003 Clear Command History; T1140 Deobfuscate/Decode Files or Information; T1218.011 Rundll32; T1497.001 System Checks
Persistence
T1037.001 Logon Script (Windows); T1053.005 Scheduled Task
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1059.006 Python; T1204 User Execution; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1573.001 Symmetric Cryptography
defense-impairment
T1112 Modify Registry; T1647 Plist File Modification
Initial Access
Resource Development
Affected products and versions in COLDRIVER (UNC4057/Star Blizzard) Re-Tools with
- Microsoft — Windows (Run dialog / rundll32 / PowerShell / Task Scheduler)
Vulnerable versions: Windows 10; Windows 11
Remediation for COLDRIVER (UNC4057/Star Blizzard) Re-Tools with
Immediate actions
- Block all listed COLDCOPY/NOROBOT/BAITSWITCH/YESROBOT/MAYBEROBOT/SIMPLEFIX domains and IPs at DNS/firewall/proxy
- Deploy provided YARA rules (G_APT_Downloader_NOROBOT_2, G_APT_BACKDOOR_YESROBOT_1, G_APT_BACKDOOR_MAYBEROBOT_1, LOSTKEYS__Strings) across EDR/AV
- Hunt for rundll32.exe spawning pythonw.exe or powershell.exe as a parent-child anomaly
- Search for the registry artifacts: HKCU\SOFTWARE\Classes\.pietas value 'ratio', and UserInitMprLogonScript modifications
- Alert on RunMRU key deletion (anti-forensic indicator) and scheduled tasks named 'System health check'
Workarounds
- Disable the Windows Run dialog via Group Policy for high-risk user groups where operationally feasible
- Restrict script host execution (wscript/cscript/rundll32) via application control for non-technical users
Longer-term hardening
- Deploy EDR with behavioral detection for ClickFix-style clipboard-to-RunDialog execution chains
- Enroll high-risk individuals (NGO staff, policy advisors, dissidents) in Google Advanced Protection Program
- Enforce AppLocker/WDAC policies restricting rundll32 execution of user-writable-path DLLs
- Disable or restrict bitsadmin usage for non-administrative users
- Conduct recurring ClickFix-specific phishing awareness training for at-risk user populations
Weaknesses (CWE) in COLDRIVER (UNC4057/Star Blizzard) Re-Tools with
CWE-506, CWE-494
Timeline of COLDRIVER (UNC4057/Star Blizzard) Re-Tools with
- Earlier COLDRIVER samples observed using Maltego-themed PE files, potentially linked to the same malware lineage that later produced LOSTKEYS.
- GTIG first observes precursor LOSTKEYS VBS stealer activity attributed to COLDRIVER, part of ongoing campaigns against NATO officials, NGOs, and journalists.
- Google Threat Intelligence Group publicly discloses the LOSTKEYS malware and its ClickFix delivery chain, attributing it to COLDRIVER/UNC4057/Star Blizzard/Callisto.
- Within five days of LOSTKEYS disclosure, COLDRIVER deploys the re-tooled chain: COLDCOPY ClickFix lure, NOROBOT v1 (iamnotarobot.dll) downloader, and the YESROBOT Python backdoor.
- YESROBOT deployment ends after only two observed victim instances over roughly two weeks, assessed by GTIG as a hastily built stopgap.
- COLDRIVER adopts MAYBEROBOT (SIMPLEFIX), a heavily obfuscated PowerShell backdoor with a 3-command custom HTTPS protocol, replacing YESROBOT as the primary implant.
- NOROBOT downloader simplified to a single-file-fetch, single-persistence model (checkme.dll), dropping the Python installation requirement.
- Zscaler publishes independent research on the same chain under the names BAITSWITCH (downloader) and SIMPLEFIX (backdoor), detailing registry-based encrypted payload storage and the fake Cloudflare Turnstile lure.
- NOROBOT downloader (machinerie.dll) re-introduces cryptographic key splitting and multiple downloader stages, increasing operational-security complexity.
- MAYBEROBOT/SIMPLEFIX remains functionally unchanged through the end of the observation window, indicating high operator confidence in the implant's stability and evasion.
- Google Threat Intelligence Group publishes full public disclosure of the NOROBOT/YESROBOT/MAYBEROBOT chain, IOCs, and YARA rules; malicious domains/hashes added to Safe Browsing and Gmail/Workspace government-backed-attacker alerts issued to targeted users.
Sources cited for COLDRIVER (UNC4057/Star Blizzard) Re-Tools with
- To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER
- COLDRIVER updates its arsenal: BAITSWITCH and SIMPLEFIX
- COLDRIVER: Using Spyware to Steal Sensitive Information from Western Targets and NGOs (LOSTKEYS)
- VirusTotal IOC Collection - COLDRIVER NOROBOT/YESROBOT/MAYBEROBOT
- MITRE ATT&CK - Star Blizzard / Callisto Group (G0139)
Threats related to COLDRIVER (UNC4057/Star Blizzard) Re-Tools with
Detection coverage for TL-2026-1510
As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1510 across Splunk SPL, Microsoft KQL and Sigma, covering 54 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1510
6 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.