New COLDRIVER Malware Campaign Targets Windows Systems: BO Team and Bearlyfy Join Russia-Focused Cyberattacks

Executive Summary

In this advisory report, Rescana presents an in-depth analysis of the new malware campaign involving COLDRIVER, BO Team, and Bearlyfy specifically targeting Russia and parts of Eastern Europe. This emerging threat leverages a multi-stage malware delivery process with sophisticated social engineering techniques to breach defenses in targeted organizations ranging from government entities to critical infrastructure providers. The operational sophistication demonstrated by these cyber adversaries highlights the urgent need to upgrade network security, strengthen endpoint defenses, and apply rigorous patch management protocols. Our analysis details the technical, operational, and tactical dimensions of the campaign while providing actionable recommendations for immediate and long-term risk mitigation.

Threat Actor Profile

The threat landscape has recently been reshaped by the activities of the reemerging and increasingly potent threat actor, COLDRIVER. Historically recognized for its connections with politically and ideologically motivated campaigns targeting dissidents and civil society organizations, COLDRIVER has now expanded its objectives to include high-value targets within Russia and its neighboring regions. The actor operates in tandem with BO Team, a group known under several aliases such as Black Owl, Hoody Hyena, and Lifting Zmiy, which has a record of deploying advanced spear-phishing strategies and PowerShell-based stagers. The collaboration extends to Bearlyfy, an emerging cyber adversary that has recently begun incorporating ransomware functionalities such as those found in LockBit 3.0 and Babuk. Bearlyfy is noted for exploiting vulnerable public-facing applications and leveraging known misconfigurations to catalyze further intrusions. The strategic convergence of these entities underlines a new era of state-sponsored or politically motivated cyber campaigns that leverage multi-layered evasion and persistence techniques, thereby intensifying overall risk exposure for organizations.

Technical Analysis of Malware/TTPs

The malware campaign employs a multi-pronged attack approach that starts with the stealthy deployment of BAITSWITCH. This initial downloader masquerades as a legitimate software update, exploiting fake CAPTCHA interfaces that prompt victims to inadvertently execute malicious commands through the Windows Run dialog. Following this initial compromise, the campaign proceeds with the delivery of SIMPLEFIX, a PowerShell-based backdoor that reliably establishes persistent command-and-control (C2) channels with dynamically changing servers located in Eastern Europe. SIMPLEFIX is observed executing remote code execution commands, thereby enabling the adversary to maintain a foothold within the compromised network. The operative chain then culminates with the deployment of LOSTKEYS, a highly advanced malware strain engineered to extract sensitive information and exfiltrate data in an encrypted format. LOSTKEYS employs targeted file searches by scanning predefined directories and selectively harvesting file types most likely to contain valuable intellectual property or confidential data.

The Tactics, Techniques, and Procedures (TTPs) employed in this campaign have been meticulously mapped to the MITRE ATT&CK framework. The initial stages of penetration are consistent with spear-phishing attachment tactics, where victims are lured by the promise of legitimate software updates and decoy documents hosted on service platforms that are perceived as safe. Once the victim’s credentials have been deceived, execution techniques primarily revolve around user execution triggers, where the malicious payload is activated by the victim following a seemingly benign interaction, such as a fake CAPTCHA verification prompt. In the persistence phase, the attackers utilize registry modifications and the exploitation of valid account credentials to cement their foothold. Lateral movement is facilitated through process injection techniques and the discreet installation of additional backdoors, ensuring that even if one entry point is fortified, the adversary’s access remains unhampered. This layered, intricate architecture is demonstrative of a highly sophisticated campaign designed to evade both network and endpoint detection systems.

Exploitation in the Wild

The exploitation observed in this campaign reveals an escalation in both technical sophistication and operational reach as early as September 2025. The adversaries have refined their tactical approaches—beginning with spear-phishing emails carrying malicious attachments disguised as routine software updates and decoy documentation housed on trusted cloud repositories. The communication protocols leveraged by BAITSWITCH involve outbound HTTP requests to suspicious domains such as “captchanom[.]top” and proactive connections to servers including “southprovesolutions[.]com.” These interactions are marked by unusual network behavior that hints at broader data exfiltration operations. Furthermore, SIMPLEFIX is integral in maintaining communication with dynamically allocated Eastern European servers, thereby hardening the adversary’s ability to pivot and maintain persistence even in the face of partial network interdiction.

For example, anomalies such as the automatic deletion of run dialog histories and unexpected registry modifications form part of the attack’s legacy, subtly masking the payload’s persistence mechanisms. The multi-layered infection chain avoids easy categorization, rendering traditional signature-based detection methods less effective. Additionally, clues such as suspicious file creation timestamps, registry alterations, and network communications patterns have been extensively correlated with known indicators of compromise (IOCs) from previous campaigns. The exploitation remains highly covert, employing decoy documents and elaborate social engineering tactics to mislead incident response efforts and delay forensic investigations.

Victimology and Targeting

The targeting matrix of this campaign is highly refined and appears to be driven by politico-strategic motives. The primary focus is on entities operating within the geopolitically sensitive regions of Russia and Eastern Europe, including government bodies, political organizations, and critical infrastructure sectors. This targeting strategy is characteristic of campaigns designed to leverage geopolitical fractures and sow discord among institutional frameworks. Victim profiles indicate that organizations with weak email security practices and outdated digital infrastructure present attractive exploitation surfaces. The campaign’s emphasis on leveraging public-facing applications, like those pioneered by compromised content management systems such as Bitrix CMS, further underscores the focus on sectors that are integral to state and municipal operations. Additionally, the sophisticated spear-phishing techniques are tailored to deceive non-technical users by imitating trusted internal communications, thereby increasing the likelihood of successful initial access. The adversaries’ objective is not merely to disrupt operational continuity but also to exfiltrate data that might compromise national security interests or alter public perceptions regarding ongoing political developments.

Victim profiles are not limited to large-scale organizations alone; smaller entities with less robust cybersecurity postures are also targeted initially by Bearlyfy, particularly as part of a strategic escalation where successful attacks against smaller companies eventually propagate into more significant, coordinated operations across broader sectors. The sophisticated combination of advanced malware and persistent backdoors, along with the strategic alignment among differing threat groups, indicates a deliberate targeting of both high-impact and high-probability vulnerabilities within the cyber infrastructures of the targeted regions.

Mitigation and Countermeasures

Organizations facing this multidimensional threat can adopt several mitigation measures to bolster their defenses. Critical to this effort is the implementation of advanced anomaly detection systems that continuously monitor and flag deviations in network traffic, particularly those attempting to connect with suspicious domains such as “captchanom[.]top” and “southprovesolutions[.]com.” The strategic deployment of endpoint detection and response (EDR) tools is equally indispensable, especially given the likelihood of atypical PowerShell script executions that signal ongoing attempts to install SIMPLEFIX or LOSTKEYS.

Enhancement of email security practices forms the cornerstone of preventing the initial compromise. This requires the tightening of email filtering rules to identify and quarantine unusual attachments or messages that prompt for immediate action, particularly those that incorporate deceptive interfaces such as fake CAPTCHA prompts. By integrating advanced sandboxing techniques and behavioral analysis, organizations can swiftly detect anomalous patterns early in the attack chain. Concurrently, a rigorous vulnerability management protocol must be established. Organizations should focus efforts on patching vulnerabilities in legacy email clients and public-facing applications that increase exposure to spear-phishing campaigns. Of particular concern are vulnerabilities associated with legacy systems that may be exploited during the initial infection phase coupled with critical privilege escalation exploits such as those identified by Zerologon.

Training and awareness programs are equally vital. It is necessary to regularly conduct cybersecurity training that educates staff members on the latest phishing tactics and deception methods employed by adversaries. Awareness sessions should focus on elucidating the significance of scrutinizing unsolicited emails, confirming the legitimacy of software updates with trusted vendors, and understanding the subtle indicators of social engineering attacks. In addition, incident response teams must be prepared with updated playbooks that consider the potential for multi-stage malware cascades and the subsequent need for system-wide forensic investigations. Collaborations with third-party threat intelligence vendors can also help organizations stay informed regarding the latest IOCs and prevalent TTPs within the threat landscape, thereby enabling proactive threat hunting and rapid containment procedures.

Organizations should also enhance logging mechanisms that capture granular details related to file system modifications, registry changes, and suspicious network socket activity to facilitate early detection of intrusion activities. Integrating these insights into automated security information and event management (SIEM) systems can help prioritize alerts based on threat severity, thereby streamlining the identification of both internal and external compromise attempts. Organizations must direct substantial resources toward developing robust, real-time countermeasures. In practice, this means investing in layered defense strategies that combine perimeter security enhancements, regular security audits, and dynamic threat modeling to reflect emerging risk determinants. These measures collectively serve to not only block unauthorized access attempts but also to reduce dwell time post initial compromise.

References

Relevant technical insights and corroborative data have been drawn from a synthesis of independently scraped sources including detailed reports by The Hacker News and GuardianMSSP, complemented by extensive alignment with the MITRE ATT&CK framework documented on the MITRE website. Supplementary insights from reputable security research entities such as Zscaler ThreatLabz and Google Threat Intelligence Group further reinforce the technical analysis presented herein. Additional references include documented advisories from the National Vulnerability Database that have underscored the systemic risk posed by outdated email clients and public-facing application vulnerabilities. All referenced frameworks and documented indictors contribute to a comprehensive understanding of this sophisticated campaign and its operational behavior.

About Rescana

Rescana remains at the forefront of third-party risk management, employing a robust TPRM platform to safeguard organizations against rapidly evolving cyber threats. Our commitment to delivering actionable intelligence and comprehensive security advisory reports empowers enterprises to make informed operational decisions while fortifying their cyber defenses against advanced threat actors. We pride ourselves on our ability to integrate cutting-edge threat intelligence with real-world operational insights, ensuring that our customers remain one step ahead in today’s hostile cyber landscape. Our extensive experience in the cybersecurity domain enables us to provide both strategic and tactical guidance that helps to mitigate risks associated with emerging complex malware campaigns. We are dedicated to ensuring that every facet of our client’s digital ecosystem is secured through proactive risk assessments, continuous monitoring, and dynamic threat response solutions.

We are happy to answer questions at ops@rescana.com.