By 
The Russia-linked hackers known as COLDRIVER was found evolving tactics, techniques and procedures (TTPs), to go beyond credential harvesting to deliver its first-ever custom malware written in the Rust programming language.
Google's Threat Analysis Group (TAG), which shared details of the latest activity, said the attack chains leverage PDFs as decoy documents to trigger the infection sequence. The lures are sent from impersonation accounts.
COLDRIVER, also known as Blue Callisto, BlueCharlie (or TAG-53), Calisto (alternately spelled Callisto), Dancing Salome, Gossamer Bear, Star Blizzard (formerly SEABORGIUM), TA446, and UNC4057, is a Russian cyberespionage group that has been targeting government officials, military personnel, journalists and think tanks since at least 2015.
In November 2022, TAG spotted COLDRIVER sending targets benign PDF documents from impersonation accounts. The lure documents are new op-ed or other types of articles that the impersonation account is looking to publish, and threat actors were asking for feedback from the recipient. When the victims open the PDF, an encrypted text is displayed.
When the recipient responds to the message stating they cannot read the document, the threat actor responds with a link to a purported decryption tool ("Proton-decrypter.exe") hosted on a cloud storage service.
The PDF document employed in the attack was hosted on Proton Drive and the attackers say the tool used to decrypt the file hosted on the cloud platform.
The decryptor is a backdoor named SPICA that grants COLDRIVER covert access to the machine, while simultaneously displaying a decoy document to keep up the ruse.
Once executed, SPICA decodes an embedded PDF, writes it to disk, and opens it as a decoy for the user. In the background, it establishes persistence and starts the main C2 loop, waiting for commands to execute.
There is evidence to suggest that the nation-state actor's use of the implant goes back to November 2022 and found multiple variants of the "encrypted" PDF lure, indicating that there could be different versions of SPICA to match the lure document sent to targets.
As part of its efforts to disrupt the campaign and prevent further exploitation, Google TAG said it added all known websites, domains, and files associated with the hacking crew to Safe Browsing blocklists.
