Russian COLDRIVER Hackers Expand Beyond Phishing with Custom Malware

The Russia-linked APT COLDRIVER (aka Calisto/Blue Callisto/TA446) has evolved from credential harvesting to deploying a custom Rust backdoor named SPICA delivered via PDF lures and a purported "Proton-decrypter.exe" hosted on cloud storage; SPICA provides C2 via JSON over WebSockets, arbitrary command execution, cookie theft, file transfer and persistence, and appears to have been used in limited targeted operations against high-value targets (NGOs, former intelligence/military officials, defense and NATO governments). Google TAG and others analyzed the campaign, added related infrastructure to Safe Browsing blocklists, and U.S./U.K. sanctions have targeted individuals linked to the group.