COLDRIVER (UNC4057/Star Blizzard) Re-Tools with NOROBOT/BAITSWITCH/YESROBOT/MAYBEROBOT/SIMPLEFIX Malware Chain After LOSTKEYS Disclosure

Key facts for COLDRIVER NOROBOT loader chain

Detection coverage for COLDRIVER NOROBOT loader chain

As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1510 across Splunk SPL, Microsoft KQL and Sigma, covering 54 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: COLDCOPY ClickFix Rundll32 -> PowerShell/Python Parent-Child Anomaly (NOROBOT/BAITSWITCH Exploitation)

Detects rundll32.exe spawning powershell.exe or python(w).exe, the observable footprint of the COLDRIVER ClickFix Run-dialog command (rundll32.exe iamnotarobot.dll,humanCheck / checkme.dll / machinerie.dll,verifyme) launching the NOROBOT/BAITSWITCH downloader stager after a victim pastes the attacker-supplied command into the Windows Run dialog.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.004, T1218.011, T1059.001, T1059.006
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\rundll32.exe" (Image="*\\powershell.exe" OR Image="*\\pythonw.exe" OR Image="*\\python.exe")
| eval cmdline_export=coalesce(ParentCommandLine, "")
| search cmdline_export="*humanCheck*" OR cmdline_export="*verifyme*" OR cmdline_export="*.dll*"
| table _time, ComputerName, User, ParentImage, ParentCommandLine, Image, CommandLine, ProcessId
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "rundll32.exe"
| where FileName in~ ("powershell.exe", "pythonw.exe", "python.exe")
| where InitiatingProcessCommandLine has_any ("humanCheck", "verifyme", "iamnotarobot.dll", "checkme.dll", "machinerie.dll")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Sigma

title: Rundll32 Spawning PowerShell or Python (COLDRIVER NOROBOT/BAITSWITCH ClickFix)
id: 8f1e6b2a-0c1a-4e2b-9a3d-1b6c7d8e9f01
status: experimental
description: Detects rundll32.exe spawning a PowerShell or Python child process, consistent with the COLDRIVER NOROBOT/BAITSWITCH ClickFix downloader chain invoked via a Run-dialog command.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/
    - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-19
tags:
    - attack.defense_evasion
    - attack.t1218.011
    - attack.execution
    - attack.t1059.001
    - attack.t1204.004
    - attack.tool.norobot
    - attack.tool.baitswitch
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\\rundll32.exe'
    selection_child:
        Image|endswith:
            - '\\powershell.exe'
            - '\\pythonw.exe'
            - '\\python.exe'
    selection_export:
        ParentCommandLine|contains:
            - 'humanCheck'
            - 'verifyme'
            - 'iamnotarobot.dll'
            - 'checkme.dll'
            - 'machinerie.dll'
    condition: selection_parent and selection_child and selection_export
falsepositives:
    - Legitimate rundll32 usage by administrative or software-deployment tooling that happens to spawn PowerShell (rare; verify export name and command line)
level: high

Known false positives:

• Legitimate rundll32-invoked administrative tooling that spawns PowerShell for unrelated maintenance tasks (rare; the exported function name filter greatly reduces this)

Tuning notes: Whitelist known-good software-deployment rundll32 invocations by ParentCommandLine hash/path if false positives occur; tighten by requiring the child process's first outbound connection within 60s of spawn.

• 🔒 COLDCOPY Lure Domain Resolution / Navigation (Fake CAPTCHA ClickFix Delivery) · unlock with TL Creds
• 🔒 Scheduled Task 'System health check' + RunMRU Deletion Anti-Forensic Chain · unlock with TL Creds
• 🔒 YESROBOT Python Backdoor C2 / VM-Evasion Discovery Burst · unlock with TL Creds
• 🔒 Rundll32 Executing DLL From User-Writable Path With NOROBOT Export Names · unlock with TL Creds
• 🔒 Obfuscated PowerShell Preceding Outbound HTTPS (MAYBEROBOT/SIMPLEFIX Backdoor Load) · unlock with TL Creds
• 🔒 Rapid Discovery Command Burst Followed by Outbound HTTPS Exfil Channel (COLDRIVER Collection/Exfil) · unlock with TL Creds
• 🔒 NOROBOT/BAITSWITCH Registry Key-Splitting + Logon-Script Persistence · unlock with TL Creds
• 🔒 MAYBEROBOT/SIMPLEFIX Custom HTTPS C2 Beacon (Short Random Path, ~3-Minute Cadence) · unlock with TL Creds

Indicators of compromise for COLDRIVER NOROBOT loader chain

As of 2026-07-19, Threadlinqs Intelligence tracks 54 indicators of compromise for TL-2026-1510.

Sample indicators (3 of 54)

• IP address: 85.239.52[.]32
• Domain: viewerdoconline[.]com
• File hash: 2e74f6bd9bf73131d3213399ed2f669ec5f75392de69edf8ce8196cd70eb6aee

Defanged, TLP:CLEAR. Full set of 54 indicators: unlock with TL Creds.

Community OSINT corroboration for COLDRIVER NOROBOT loader chain

6 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How COLDRIVER NOROBOT loader chain works

GTIG assesses this as the most aggressively used COLDRIVER toolset to date, with continuous chain evolution from May through September 2025.

COLDRIVER (UNC4057/Star Blizzard/Callisto), a Russian FSB-linked state-sponsored intelligence-collection actor, operationalized an entirely new malware chain within five days of the public disclosure of its LOSTKEYS VBS stealer in May 2025. The new chain begins with a ClickFix social-engineering lure (internally COLDCOPY) presenting a fake Cloudflare Turnstile/CAPTCHA 'verify you are not a robot' page that instructs the victim to copy a command into the Windows Run dialog, executing `rundll32.exe` against a remotely-hosted DLL (`iamnotarobot.dll` / `checkme.dll` / `machinerie.dll`) exporting `humanCheck` or `verifyme`. This DLL downloader — tracked as NOROBOT by GTIG and independently as BAITSWITCH by Zscaler — establishes registry- and logon-script-based persistence, splits AES decryption keys across multiple registry values (`EnthusiastMode`, `QatItems`, and a custom `.pietas` class key) and multiple network fetches to frustrate single-artifact analysis, deletes `RunMRU` history to cover tracks, and retrieves a PowerShell stager that decrypts and loads a backdoor on next logon. Between May and early June 2025 the downloader delivered YESROBOT, a Python 3.8 backdoor requiring a bundled SFX Python interpreter install, HTTPS beaconing with base64-encoded system info in the User-Agent, AES-encrypted command retrieval, and execution restricted to raw Python code — assessed by GTIG as a hastily-built, noisy stopgap abandoned after only two observed victims. From June 2025 onward COLDRIVER shifted to MAYBEROBOT (SIMPLEFIX in Zscaler's naming), a heavily obfuscated PowerShell backdoor with a compact three-command custom HTTPS protocol (download-and-execute, cmd.exe command execution, PowerShell block execution) that avoids the Python dependency, beacons roughly every three minutes with hostname/username/machine-UUID identifiers, and remained functionally unchanged through the September 2025 observation window — indicating high operator confidence in its stability and evasion. The downloader itself continued to iterate: simplified in June 2025 to a single-fetch/single-persistence model, then deliberately re-complicated in late August 2025 with re-introduced key-splitting and multi-stage downloads, reflecting a deliberate operational-security trade-off between deployment speed and defender reconstruction difficulty. Targeting is consistent with COLDRIVER's long-running mission: NGOs, policy advisors, journalists, think tanks, former NATO/Western government and intelligence officials, and exiled members of Russian civil society (human rights defenders, educators, civic activists), often lured with decoy documents themed around resilience programs for exiled Russians. The chain is fully living-off-the-land and social-engineering driven — no CVE or software vulnerability is exploited; compromise depends entirely on the victim manually executing an attacker-supplied command. Google added all observed domains and hashes to Safe Browsing, issued government-backed-attacker warnings to targeted Gmail/Workspace users, and published YARA detection rules for NOROBOT, YESROBOT, and MAYBEROBOT. The rapid five-day re-tooling turnaround after the LOSTKEYS takedown, combined with a mature, unchanged backdoor and iterative downloader hardening over four months, indicates pre-built contingency tooling and sustained resourcing consistent with an FSB-directed persistent-access mission against Western and Russian-diaspora targets.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1119 Automated Collection

Discovery

T1016 System Network Configuration Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1120 Peripheral Device Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1070.003 Clear Command History; T1140 Deobfuscate/Decode Files or Information; T1218.011 Rundll32; T1497.001 System Checks

Persistence

T1037.001 Logon Script (Windows); T1053.005 Scheduled Task

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1059.006 Python; T1204 User Execution; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1573.001 Symmetric Cryptography

defense-impairment

T1112 Modify Registry; T1647 Plist File Modification

Initial Access

T1566 Phishing

Resource Development

T1583.001 Domains; T1587.001 Malware

Remediation for COLDRIVER NOROBOT loader chain

Immediate actions

• Block all listed COLDCOPY/NOROBOT/BAITSWITCH/YESROBOT/MAYBEROBOT/SIMPLEFIX domains and IPs at DNS/firewall/proxy
• Deploy provided YARA rules (G_APT_Downloader_NOROBOT_2, G_APT_BACKDOOR_YESROBOT_1, G_APT_BACKDOOR_MAYBEROBOT_1, LOSTKEYS__Strings) across EDR/AV
• Hunt for rundll32.exe spawning pythonw.exe or powershell.exe as a parent-child anomaly
• Search for the registry artifacts: HKCU\SOFTWARE\Classes\.pietas value 'ratio', and UserInitMprLogonScript modifications
• Alert on RunMRU key deletion (anti-forensic indicator) and scheduled tasks named 'System health check'

Workarounds

• Disable the Windows Run dialog via Group Policy for high-risk user groups where operationally feasible
• Restrict script host execution (wscript/cscript/rundll32) via application control for non-technical users

Longer-term hardening

• Deploy EDR with behavioral detection for ClickFix-style clipboard-to-RunDialog execution chains
• Enroll high-risk individuals (NGO staff, policy advisors, dissidents) in Google Advanced Protection Program
• Enforce AppLocker/WDAC policies restricting rundll32 execution of user-writable-path DLLs
• Disable or restrict bitsadmin usage for non-administrative users
• Conduct recurring ClickFix-specific phishing awareness training for at-risk user populations

Affected and fixed versions

• Microsoft — Windows (Run dialog / rundll32 / PowerShell / Task Scheduler)
  Vulnerable versions: Windows 10; Windows 11

Timeline of COLDRIVER NOROBOT loader chain

• 2023-12-01 Earlier COLDRIVER samples observed using Maltego-themed PE files, potentially linked to the same malware lineage that later produced locked-ioc-52.
• 2025-01-15 GTIG first observes precursor locked-ioc-52 VBS stealer activity attributed to COLDRIVER, part of ongoing campaigns against NATO officials, NGOs, and journalists.
• 2025-05-07 Google Threat Intelligence Group publicly discloses the locked-ioc-52 malware and its ClickFix delivery chain, attributing it to COLDRIVER/UNC4057/Star Blizzard/Callisto.
• 2025-05-12 Within five days of locked-ioc-52 disclosure, COLDRIVER deploys the re-tooled chain: locked-ioc-51 ClickFix lure, locked-ioc-53 v1 (locked-ioc-37) downloader, and the locked-ioc-50 Python backdoor.
• 2025-05-25 locked-ioc-50 deployment ends after only two observed victim instances over roughly two weeks, assessed by GTIG as a hastily built stopgap.
• 2025-06-05 COLDRIVER adopts locked-ioc-47 (locked-ioc-49), a heavily obfuscated PowerShell backdoor with a 3-command custom HTTPS protocol, replacing locked-ioc-50 as the primary implant.
• 2025-06-10 locked-ioc-53 downloader simplified to a single-file-fetch, single-persistence model (locked-ioc-45), dropping the Python installation requirement.
• 2025-08-01 Zscaler publishes independent research on the same chain under the names locked-ioc-46 (downloader) and locked-ioc-49 (backdoor), detailing registry-based encrypted payload storage and the fake Cloudflare Turnstile lure.
• 2025-08-25 locked-ioc-53 downloader (locked-ioc-41) re-introduces cryptographic key splitting and multiple downloader stages, increasing operational-security complexity.
• 2025-09-30 locked-ioc-47/locked-ioc-49 remains functionally unchanged through the end of the observation window, indicating high operator confidence in the implant's stability and evasion.
• 2025-10-20 Google Threat Intelligence Group publishes full public disclosure of the locked-ioc-53/locked-ioc-50/locked-ioc-47 chain, IOCs, and YARA rules; malicious domains/hashes added to Safe Browsing and Gmail/Workspace government-backed-attacker alerts issued to targeted users.

Sources cited for COLDRIVER NOROBOT loader chain

• COLDRIVER updates its arsenal: BAITSWITCH and SIMPLEFIX zscaler.com · Vendor report · 2025-08-01
• VirusTotal IOC Collection - COLDRIVER NOROBOT/YESROBOT/MAYBEROBOT virustotal.com · Research · 2025-10-20
• MITRE ATT&CK - Star Blizzard / Callisto Group (G0139) MITRE · Research · 2025-01-01
• To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER Google Cloud · Blog · 2025-10-20
• COLDRIVER: Using Spyware to Steal Sensitive Information from Western Targets and NGOs (LOSTKEYS) Google Cloud · Blog · 2025-05-07

Threats related to COLDRIVER NOROBOT loader chain

• UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to Deploy LunchPoke, BurnyBear, MatchBoil V2 Malware

More from Cold River

• Star Blizzard (FSB) RedFlick mass-phishing campaigns deliver CosmicPulse backdoor, expanding beyond Ukraine
• Star Blizzard (SEABORGIUM) RedFlick technique: scheduled-task backdoor delivery via phishing (CosmicPulse)

Previous and next in malware

• UNC6229: Vietnamese Actors Use Fake Job Posting Campaigns to Deliver RATs and Steal Credentials Previous report
• DPRK's UNC5342 Adopts EtherHiding to Deliver JADESNOW and INVISIBLEFERRET via Blockchain Smart Contracts Next report