Recent Cyber Threats: The COLDRIVER Campaign and Emerging Attack Groups
Overview of COLDRIVER’s Tactics
Recently, the Russian advanced persistent threat (APT) group known as COLDRIVER has been linked to a new series of cyberattacks employing ClickFix methodologies. This campaign introduces two new lightweight malware families, BAITSWITCH and SIMPLEFIX, to enhance their cyber arsenal. According to Zscaler ThreatLabz, which identified this multi-stage ClickFix attack, BAITSWITCH functions primarily as a downloader, ultimately deploying SIMPLEFIX, a PowerShell backdoor.
COLDRIVER, sometimes referred to as Callisto, Star Blizzard, or UNC4057, has been active since 2019, targeting a diverse range of sectors. Initially, the group’s tactics relied on spear-phishing techniques to lure victims to credential harvesting sites. Over time, they have expanded their toolkit, incorporating sophisticated custom tools like SPICA and LOSTKEYS, reflecting their growing technical capabilities.
ClickFix Approach: Phishing and Execution
The recent campaign’s modus operandi closely mirrors previous ClickFix tactics documented by the Google Threat Intelligence Group in May 2025. In that instance, attackers created fraudulent sites presenting fake CAPTCHA prompts to lure users into executing a PowerShell command, which then delivered the LOSTKEYS Visual Basic Script.
The current attack strategy again utilizes a deceptive approach, tricking victims into executing a malicious DLL file under the pretense of completing a CAPTCHA verification. This DLL, titled BAITSWITCH, communicates with an attacker-controlled domain, "captchanom[.]top," to retrieve the SIMPLEFIX backdoor, while simultaneously presenting a decoy document hosted on Google Drive.
Upon execution, BAITSWITCH engages in multiple HTTP requests to the same domain, gathering system information, facilitating command receipt for persistence, and storing encrypted payloads within the Windows Registry. Additionally, the malicious DLL clears any recent command entries in the Windows Run dialog, erasing traces of the infection.
The downloaded PowerShell stager then reaches out to another server ("southprovesolutions[.]com") to obtain SIMPLEFIX. This backdoor establishes communication with a command-and-control (C2) server, running a variety of PowerShell scripts and remote commands.
Sophisticated Payload Exfiltration
One significant PowerShell script executed via SIMPLEFIX is designed to exfiltrate data related to specific file types, looking within defined directories. This targeted scanning aligns with the earlier tactics employed by LOSTKEYS.
Zscaler’s analysis indicates that COLDRIVER typically targets non-governmental organizations (NGOs), human rights advocates, and think tanks located in the West, alongside individuals exiled from or residing within Russia. This campaign’s focus reveals a clear alignment with their historical victimology.
The BO Team and Bearlyfy Rise in Russia
In addition to COLDRIVER’s activities, Kaspersky has reported a new phishing campaign by the BO Team group, previously known under various aliases like Black Owl and Hoody Hyena. This group is currently targeting Russian companies, leveraging password-protected RAR archives to deliver an updated version of BrockenDoor written in C# and a new iteration of ZeronetKit.
ZeronetKit, a Golang-based backdoor, is designed with functionalities that enable remote access to compromised systems, file uploads and downloads, command execution, and even TCP/IPv4 tunneling. Recent upgrades have enhanced its capabilities, allowing for shellcode execution and dynamic adjustments to communication intervals with the C2 servers.
The BO Team utilizes BrockenDoor to ensure persistence by copying the downloaded ZeronetKit backdoor to the system’s startup processes.
Emergence of the Bearlyfy Group
Another notable development is the rise of the Bearlyfy group, which has been deploying ransomware strains like LockBit 3.0 and Babuk in attacks focused on various Russian firms. Initially targeting smaller entities for lower ransoms, the group has recently escalated its operations against larger companies since April 2025—reportedly claiming at least 30 victims as of August 2025.
In one specific incident, a consulting firm was targeted using a vulnerable Bitrix version for initial access, followed by privilege escalation via the Zerologon flaw. Another attack in July was linked to a breach through an unnamed partner organization.
Reportedly, ransoms range widely, with attackers demanding €80,000 in one case, while smaller sums were seen in earlier attacks. Due to the relatively modest ransom demands, many victims opt to purchase decryptors directly from the attackers.
Bearlyfy has been active since January 2025 and shares some similarities with PhantomCore, a pro-Ukrainian threat group involved in targeting Russian and Belarusian businesses. Nonetheless, Bearlyfy is considered an independent group, differentiating itself by executing rapid attacks with minimal preparation, primarily focusing on disruption through encryption or data alteration.
Conclusion
The ongoing threat landscape, marked by activities from groups like COLDRIVER, BO Team, and Bearlyfy, underscores the sophisticated and dynamic nature of cyberattacks. As these entities evolve their tactics, the importance of vigilance and robust cybersecurity measures cannot be overstated.
