Russian COLDRIVER Group Uses New Backdoor to Target Governments

A well-established and prolific threat group that has focused on phishing and hack-and-leak operations in the last few years has begun to move up the food chain recently, employing a new backdoor known as SPICA in attacks on members of NATO government agencies, NGOs, and other sensitive organizations.

Researchers with Google’s Threat Analysis Group (TAG) have observed the group it refers to as COLDRIVER using the Spica malware in operations targeting high-profile individuals since at least September. COLDRIVER--also known as …

attacks backdoor coldriver food google government government agencies hack leak nato ngos operations organizations phishing researchers russian sensitive target threat threat group