Google TAG: Kremlin cyber spies move into malware with a custom backdoor

Google TAG attributes a custom Rust backdoor called SPICA to the Kremlin-linked COLDRIVER APT (aka Star Blizzard/UNC4057), reporting targeted spearphishing campaigns beginning as early as November 2022 that used impersonated email accounts and decoy PDFs to deliver a JSON-over-websockets C2 backdoor capable of executing shell commands, stealing browser cookies and documents, and transferring files; TAG published analysis and IoCs including hashes and C2 addresses.