COLDRIVER using new malware to steal from Western targets — Google

By: bitcoin ethereum news|2025/05/08 21:15:01
0
Share
copy
Threat group COLDRIVER is using new malware to steal documents from Western targets, according to a May 7 report from Google Threat Intelligence. The malware, called LOSTKEYS, shows the evolution of the group from credential phishing to more sophisticated attacks. According to the Google report, the new malware is installed through four steps. The process involves a “lure website” with a fake CAPTCHA, a PowerShell script downloaded to the user’s clipboard, some device evasion, and retrieval of the final payload. Lastly, the malware is installed. LOSTKEYS is capable of stealing files from extensions and directories. It can also send system information and running processes back to COLDRIVER. The address from which the parts of the attack come is “165.227.148[.]68” according to Google. The company says it has already taken steps to mitigate any damage the LOSTKEYS malware will cause, including adding the malicious websites to the company’s “Safe Browsing” feature. According to Google, COLDRIVER is a Russian-backed threat group that typically engages in phishing attempts at high-profile Western targets, such as former diplomats, and journalists. In January 2024, it started an attack with a malware called “Spica,” which can execute arbitrary shell commands and download or upload software. Related: Crypto drainers now sold as easy-to-use malware at IT industry fairs Crypto hack losses hit all-time high in 2025 Crypto hacks have surged in 2025, with total losses reaching $2 billion in the first quarter alone — exceeding all losses recorded in 2024. According to a report by crypto cybersecurity firm Hacken, operational flaws and weak access controls remain key vulnerabilities — even among major centralized and decentralized players. Attackers are also increasingly using social engineering tactics to gain victims’ trust. Contributing to last quarter’s losses was the $1.5 billion hack of cryptocurrency exchange Bybit. The February attack was reportedly orchestrated by the Lazarus Group. Magazine: Lazarus Group’s favorite exploit revealed — Crypto hacks analysis Source: https://cointelegraph.com/news/coldriver-new-malware-steal-western-targets-google?utm_source=rss_feed&utm_medium=feed&utm_campaign=rss_partner_inbound

You may also like

Tiger Research: What AI services do cryptocurrency companies offer?

Cryptocurrency giants like Binance and Coinbase have fully launched an AI defense battle: Driven by FOMO sentiment, leading platforms are accelerating the deep integration of AI agents into core businesses such as trading, security, and payments.

The war not only drives up oil prices but also causes Circle's stock price to soar

High interest rate expectations combined with the explosive growth of stablecoin infrastructure have led to Circle's stock price doubling in five weeks against the trend: Understanding the dual game of "macro interest rate trading" and "global payment foundation" behind the surge in one article.

When agents become consumers, who will rewrite the underlying logic of internet commerce?

Thirty years ago, due to the high cost of micropayments, the internet had no choice but to adopt an advertising model. Today, the technical threshold for micropayments is nearly zero, but trust has become the most expensive luxury. Whoever can bridge this gap will dominate the next generation of int...

AI Agents in Action Summit: March 31, Hong Kong Cyberport, focusing on the deep waters of AI implementation

Tomorrow, Hong Kong Cyberport will grandly open. The "AI Agents in Action" summit gathers top experts, directly addressing the real evolution of AI Agents from conceptual celebration to productization and large-scale commercial implementation.

29 Days In, What Are America’s Options on Iran?

The key is not in ground invasion but in the combination of striking capability and governance.

Flash Crash Down 97%+ with Ongoing Unlocking, WLD Completes $65 Million Off-chain Funding: Who Is Still Buying?

In the current deep bear market environment, being able to complete multi-million dollar token trades is quite rare.

Popular coins

Latest Crypto News

Read more