The Russian hacking group COLDRIVER has released several new versions of its malware since May 2025, and the pace is increasing with each update.

Google’s Threat Intelligence Group (GTIG) took note of this. They found that just five days after the release of COLDRIVER’s LOSTKEYS malware, hackers began modifying and reorganizing their toolkit. This rapid change shows that they are moving faster than ever.

No one knows for sure how long this new malware family has been operating. However, Google’s team says they haven’t found a single LOSTKEYS infection since the announcement. It simply disappeared.

On Monday, GTIG researcher Wesley Shields explained what’s new. This new malware, codenamed NOROBOT, YESROBOT, and MAYBEROBOT, is not just a threat. Shields describes it as “a collection of related malware families connected through a distribution chain.” Therefore, COLDRIVER isn’t just evolving. They’re forming an entire network of threats that work together.

Malware Evolution Overview

It all started with a new malicious DLL named NOROBOT. The attackers used an updated COLDCOPY “ClickFix” lure that cleverly disguises itself as a custom CAPTCHA. The method is the same as the one used by COLDRIVER in the LOSTKEYS attack, only this time, things have been simplified for the victim. Now the user doesn’t have to go through multiple PowerShell steps; just run the DLL from rundll32, and the job is done.

Initially, NOROBOT installed a dangerous Python backdoor called YESROBOT, but it didn’t last long. Then COLDRIVER abandoned it and switched to a new PowerShell backdoor, which is even more flexible and powerful. We recognize it as MAYBEROBOT.

NOROBOT and its previous attack patterns are constantly evolving. It appears they initially kept things simple to target more people, but then gradually increased complexity by sharing crypto keys, making their activities increasingly difficult to track. This constant change demonstrates the agility and precision with which this group operates, avoiding detection and continuing to spy on its high-value targets.

Delivery via “ClickFix” and Rundll32

This new malware attack consists of three distinct components, all derived from an updated version of COLDCOPY called “ClickFix.” This latest version of COLDCOPY tricks users into downloading and running a DLL file using rundll32. Interestingly, to disguise itself, the malware displays CAPTCHA-like text to make it appear as if the user is actually being asked if they are a robot. The first DLL it spotted was named “iamnotarobot.dll,” and it contained an export called “humanCheck.” Both names match the CAPTCHA theme of the page, and subsequent malware also has robot-themed names.

Phishing or Malware?

It’s still unclear why COLDRIVER abandoned their traditional phishing tactics and deployed malware directly. They’re known for this kind of phishing. But one thing is clear: they’ve put a lot of effort into redeploying and modifying their malware against specific targets. It appears COLDRIVER is now attempting to deploy NOROBOT and MAYBEROBOT on the systems of those very important individuals whose data they’ve already stolen through phishing. They’re now looking to extract even more intelligence directly from their devices.

As COLDRIVER continues this series, we’re confident they’ll continue to employ similar aggressive tactics against high-value targets to meet their intelligence needs.

Frequently Asked Questions (FAQs)