{
  "name": "COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs",
  "slug": "coldriver-using-new-malware-to-steal-documents-from-western-targets-and-ngos",
  "description": "Russian government-backed threat group COLDRIVER has developed a new malware called LOSTKEYS, capable of stealing files and system information. The group targets high-profile individuals, NGOs, and former intelligence officers through credential phishing and malware delivery. LOSTKEYS is delivered through a multi-step infection chain, starting with a fake CAPTCHA and involving PowerShell commands. The malware evades detection in VMs and uses a substitution cipher for decoding. COLDRIVER's primary goal is intelligence collection for Russia's strategic interests, targeting Western governments, militaries, journalists, and Ukraine-related individuals. The group has been linked to hack-and-leak campaigns in the UK and against NGOs.",
  "published": "2025-05-07T16:05:20+00:00",
  "created_at": "2025-05-07T16:05:20+00:00",
  "modified_at": "2025-05-07T19:13:32+00:00",
  "created_at_opencti": "2025-05-07T16:05:20+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-05-07",
    "clickfix",
    "credential-theft",
    "document theft",
    "lostkeys",
    "ngos",
    "phishing",
    "powershell",
    "spica"
  ],
  "related_entities": {
    "malware": [
      {
        "id": "ee601d63-ebfb-4928-8a53-686aab2996cc",
        "name": "LOSTKEYS",
        "slug": "lostkeys"
      }
    ],
    "intrusion_sets": [
      {
        "id": "legacy:intrusion:232b3b6e9119ba9c",
        "name": "COLDRIVER",
        "slug": "coldriver"
      }
    ],
    "attack_patterns": [
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "29398669-98ed-4766-9dac-f9632f7175ff",
        "name": "T1518"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Ukraine"
      },
      {
        "id": "",
        "name": "Media"
      },
      {
        "id": "",
        "name": "Defense"
      },
      {
        "id": "",
        "name": "NGO"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-documents-western-targets-ngos",
    "https://otx.alienvault.com/pulse/681ba0e01c36344c7ac60892"
  ]
}