# COLDRIVER (UNC4057/Star Blizzard) Re-Tools with NOROBOT/BAITSWITCH/YESROBOT/MAYBEROBOT/SIMPLEFIX Malware Chain After LOSTKEYS Disclosure

> Russian state-sponsored group COLDRIVER (aka UNC4057, Star Blizzard, Callisto) rapidly re-tooled within five days of its May 2025 LOSTKEYS disclosure, deploying a new ClickFix-style infection chain (COLDCOPY lure -> BAITSWITCH/NOROBOT DLL downloader -> YESROBOT or MAYBEROBOT/SIMPLEFIX backdoor) against NGOs, policy advisors, and Russian civil-society dissidents. GTIG assesses this as the most aggressively used COLDRIVER toolset to date, with continuous chain evolution from May through September 2025.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1510
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-coldriver-norobot-loader-chain-tl-2026-1510.webp?v=c407ac7e (Threadlinqs threat intel: COLDRIVER NOROBOT Chain: Detection & IOCs (TL-2026-1510) — High severity, 54 IOCs, 9 detection rules.)
- **ID:** TL-2026-1510
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Cold River (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 54 (3 shown free below)

## Description

COLDRIVER (UNC4057/Star Blizzard/Callisto), a Russian FSB-linked state-sponsored intelligence-collection actor, operationalized an entirely new malware chain within five days of the public disclosure of its LOSTKEYS VBS stealer in May 2025. The new chain begins with a ClickFix social-engineering lure (internally COLDCOPY) presenting a fake Cloudflare Turnstile/CAPTCHA 'verify you are not a robot' page that instructs the victim to copy a command into the Windows Run dialog, executing `rundll32.exe` against a remotely-hosted DLL (`iamnotarobot.dll` / `checkme.dll` / `machinerie.dll`) exporting `humanCheck` or `verifyme`. This DLL downloader — tracked as NOROBOT by GTIG and independently as BAITSWITCH by Zscaler — establishes registry- and logon-script-based persistence, splits AES decryption keys across multiple registry values (`EnthusiastMode`, `QatItems`, and a custom `.pietas` class key) and multiple network fetches to frustrate single-artifact analysis, deletes `RunMRU` history to cover tracks, and retrieves a PowerShell stager that decrypts and loads a backdoor on next logon. Between May and early June 2025 the downloader delivered YESROBOT, a Python 3.8 backdoor requiring a bundled SFX Python interpreter install, HTTPS beaconing with base64-encoded system info in the User-Agent, AES-encrypted command retrieval, and execution restricted to raw Python code — assessed by GTIG as a hastily-built, noisy stopgap abandoned after only two observed victims. From June 2025 onward COLDRIVER shifted to MAYBEROBOT (SIMPLEFIX in Zscaler's naming), a heavily obfuscated PowerShell backdoor with a compact three-command custom HTTPS protocol (download-and-execute, cmd.exe command execution, PowerShell block execution) that avoids the Python dependency, beacons roughly every three minutes with hostname/username/machine-UUID identifiers, and remained functionally unchanged through the September 2025 observation window — indicating high operator confidence in its stability and evasion. The downloader itself continued to iterate: simplified in June 2025 to a single-fetch/single-persistence model, then deliberately re-complicated in late August 2025 with re-introduced key-splitting and multi-stage downloads, reflecting a deliberate operational-security trade-off between deployment speed and defender reconstruction difficulty. Targeting is consistent with COLDRIVER's long-running mission: NGOs, policy advisors, journalists, think tanks, former NATO/Western government and intelligence officials, and exiled members of Russian civil society (human rights defenders, educators, civic activists), often lured with decoy documents themed around resilience programs for exiled Russians. The chain is fully living-off-the-land and social-engineering driven — no CVE or software vulnerability is exploited; compromise depends entirely on the victim manually executing an attacker-supplied command. Google added all observed domains and hashes to Safe Browsing, issued government-backed-attacker warnings to targeted Gmail/Workspace users, and published YARA detection rules for NOROBOT, YESROBOT, and MAYBEROBOT. The rapid five-day re-tooling turnaround after the LOSTKEYS takedown, combined with a mature, unchanged backdoor and iterative downloader hardening over four months, indicates pre-built contingency tooling and sustained resourcing consistent with an FSB-directed persistent-access mission against Western and Russian-diaspora targets.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1053.005 Scheduled Task
- T1037.001 Logon Script (Windows)
- T1647 Plist File Modification
- T1218.011 Rundll32
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1112 Modify Registry
- T1497.001 System Checks
- T1070.003 Clear Command History
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1049 System Network Connections Discovery
- T1083 File and Directory Discovery
- T1120 Peripheral Device Discovery
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1095 Non-Application Layer Protocol
- T1005 Data from Local System
- T1119 Automated Collection
- T1041 Exfiltration Over C2 Channel
- T1583.001 Domains
- T1587.001 Malware

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**COLDCOPY ClickFix Rundll32 -> PowerShell/Python Parent-Child Anomaly (NOROBOT/BAITSWITCH Exploitation)** (`TL-2026-1510-SPL-001`)

Detects rundll32.exe spawning powershell.exe or python(w).exe, the observable footprint of the COLDRIVER ClickFix Run-dialog command (rundll32.exe iamnotarobot.dll,humanCheck / checkme.dll / machinerie.dll,verifyme) launching the NOROBOT/BAITSWITCH downloader stager after a victim pastes the attacker-supplied command into the Windows Run dialog.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1218.011, T1059.001, T1059.006
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\rundll32.exe" (Image="*\\powershell.exe" OR Image="*\\pythonw.exe" OR Image="*\\python.exe")
| eval cmdline_export=coalesce(ParentCommandLine, "")
| search cmdline_export="*humanCheck*" OR cmdline_export="*verifyme*" OR cmdline_export="*.dll*"
| table _time, ComputerName, User, ParentImage, ParentCommandLine, Image, CommandLine, ProcessId
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "rundll32.exe"
| where FileName in~ ("powershell.exe", "pythonw.exe", "python.exe")
| where InitiatingProcessCommandLine has_any ("humanCheck", "verifyme", "iamnotarobot.dll", "checkme.dll", "machinerie.dll")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Rundll32 Spawning PowerShell or Python (COLDRIVER NOROBOT/BAITSWITCH ClickFix)
id: 8f1e6b2a-0c1a-4e2b-9a3d-1b6c7d8e9f01
status: experimental
description: Detects rundll32.exe spawning a PowerShell or Python child process, consistent with the COLDRIVER NOROBOT/BAITSWITCH ClickFix downloader chain invoked via a Run-dialog command.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/
    - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-19
tags:
    - attack.defense_evasion
    - attack.t1218.011
    - attack.execution
    - attack.t1059.001
    - attack.t1204.004
    - attack.tool.norobot
    - attack.tool.baitswitch
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\\rundll32.exe'
    selection_child:
        Image|endswith:
            - '\\powershell.exe'
            - '\\pythonw.exe'
            - '\\python.exe'
    selection_export:
        ParentCommandLine|contains:
            - 'humanCheck'
            - 'verifyme'
            - 'iamnotarobot.dll'
            - 'checkme.dll'
            - 'machinerie.dll'
    condition: selection_parent and selection_child and selection_export
falsepositives:
    - Legitimate rundll32 usage by administrative or software-deployment tooling that happens to spawn PowerShell (rare; verify export name and command line)
level: high
```

**Known false positives:**

- Legitimate rundll32-invoked administrative tooling that spawns PowerShell for unrelated maintenance tasks (rare; the exported function name filter greatly reduces this)

**Tuning notes:** Whitelist known-good software-deployment rundll32 invocations by ParentCommandLine hash/path if false positives occur; tighten by requiring the child process's first outbound connection within 60s of spawn.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- COLDCOPY Lure Domain Resolution / Navigation (Fake CAPTCHA ClickFix Delivery) (locked: unlock with TL Creds)
- Scheduled Task 'System health check' + RunMRU Deletion Anti-Forensic Chain (locked: unlock with TL Creds)
- YESROBOT Python Backdoor C2 / VM-Evasion Discovery Burst (locked: unlock with TL Creds)
- Rundll32 Executing DLL From User-Writable Path With NOROBOT Export Names (locked: unlock with TL Creds)
- Obfuscated PowerShell Preceding Outbound HTTPS (MAYBEROBOT/SIMPLEFIX Backdoor Load) (locked: unlock with TL Creds)
- Rapid Discovery Command Burst Followed by Outbound HTTPS Exfil Channel (COLDRIVER Collection/Exfil) (locked: unlock with TL Creds)
- NOROBOT/BAITSWITCH Registry Key-Splitting + Logon-Script Persistence (locked: unlock with TL Creds)
- MAYBEROBOT/SIMPLEFIX Custom HTTPS C2 Beacon (Short Random Path, ~3-Minute Cadence) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 54)

Defanged, TLP:CLEAR.

- IP address: `85.239.52[.]32`
- Domain: `viewerdoconline[.]com`
- File hash: `2e74f6bd9bf73131d3213399ed2f669ec5f75392de69edf8ce8196cd70eb6aee`

Full set of 54 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER](https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/)
- [COLDRIVER updates its arsenal: BAITSWITCH and SIMPLEFIX](https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix)
- [COLDRIVER: Using Spyware to Steal Sensitive Information from Western Targets and NGOs (LOSTKEYS)](https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-documents-western-targets-ngos)
- [VirusTotal IOC Collection - COLDRIVER NOROBOT/YESROBOT/MAYBEROBOT](https://www.virustotal.com/gui/collection/58341e00c39370af40104d9ca51e9fe33361afeca771f1aa433cc1c901e2f82e/iocs)
- [MITRE ATT&CK - Star Blizzard / Callisto Group (G0139)](https://attack.mitre.org/groups/G0139/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1510