Russian State-Sponsored Threat Actor Targets High Profile Individuals in Phishing Campaign

COLDRIVER, a Russian state-linked actor, is conducting targeted credential-phishing campaigns against NATO countries, Ukraine, NGOs, and high-profile individuals. The actor uses impersonation accounts to share benign-looking PDFs; when recipients report they cannot read the document, COLDRIVER supplies a cloud-hosted “decryption” utility that is actually the SPICA Rust backdoor, enabling shell command execution, browser cookie theft, file transfer, and document exfiltration.