Threat Research

After the public disclosure of its LOSTKEYS malware in May 2025, the Russian state-sponsored threat group COLDRIVER (also known as UNC4057, Star Blizzard, and Callisto) quickly adapted, launching new malware families within just five days....

In September 2025, our team uncovered a new multi-stage ClickFix campaign likely aimed at Russian civil society. The campaign is attributed with moderate confidence to the Russia-linked APT group COLDRIVER. COLDRIVER, also known as Star Blizzard or Callisto, is known for credential phishing and targeting NGOs, journalists, and activists....