Google says Russian espionage crew behind new malware campaign

Google's Threat Analysis Group reports that the Russian-linked APT Cold River has shifted from phishing to using benign-looking PDFs as lures to deliver a custom backdoor named SPICA. The malware provides persistent access, command execution, browser cookie theft and document exfiltration; targets include Ukraine, NATO allies, academic institutions and NGOs, and Google added identified sites and files to Safe Browsing.