Google: Russia's ColdRiver APT Unleashes Custom 'Spica' Malware

ColdRiver (aka Star Blizzard/Blue Charlie/UNC4057) has incorporated a custom Rust-based backdoor called "Spica" into targeted phishing campaigns: attackers send benign-looking PDFs, then trick recipients into running a malicious "decryption" utility that installs Spica, which uses JSON-over-WebSockets C2 and can execute shell commands, steal browser cookies, enumerate and exfiltrate documents. Google TAG researchers observed limited, targeted use against Ukraine, NATO countries, NGOs and academic institutions; the activity is attributed to a Kremlin-aligned actor and presents elevated espionage risk especially around election-related targeting.