US EditionGoogle identifies new malware linked to Russia-based hacking group
- On May 7, 2025, Google Threat Intelligence Group revealed LOSTKEYS malware linked to the Russian-based Cold River hacking group targeting Western entities.
- Cold River, previously tied to Russia’s Federal Security Service, conducts credential theft and espionage primarily for intelligence supporting Russian strategic interests.
- LOSTKEYS enables file theft and system data exfiltration via selective multi-step social engineering attacks beginning with fake CAPTCHA lure websites.
- Google reported that the malware LOSTKEYS can exfiltrate files from specified directories and transmit details about the affected system and active programs back to attackers, representing an advancement in Cold River’s hacking capabilities.
- The U.S. Sanctioned and indicted two Cold River operators in December 2023, offering up to $10 million for tips, while Google urges enhanced protections against these targeted attacks.
15 Articles
15 Articles
Google links new LostKeys data theft malware to Russian cyberspies
Since the start of the year, the Russian state-backed ColdRiver hacking group has been using new LostKeys malware to steal files in espionage attacks targeting Western governments, journalists, think tanks, and non-governmental organizations.
Google identifies new malware linked to Russian hackers: ‘New development in the toolset’
Alphabet's Google said on Wednesday it has identified new malware called "LOSTKEYS" tied to the Russian-based hacking group Cold River, which is capable of stealing files and sending system information to attackers.
Channel News Asia
The Straits TimesGoogle identifies new malware linked to Russia-based hacking group
Alphabet's Google said on Wednesday it has identified new malware called "LOSTKEYS" tied to the Russian-based hacking group Cold River, which is capable of stealing files and sending system information to attackers.The malware "marks a new development in the toolset" of Cold River, Wesley Shields, a researche
Russian Hackers Using ClickFix Fake CAPTCHA To Deploy New LOSTKEYS Malware - Cybernoz - Cybersecurity News
The Russia-linked threat actor known as COLDRIVER has been observed distributing a new malware called LOSTKEYS as part of an espionage-focused campaign using ClickFix-like social engineering lures. “LOSTKEYS is capable of stealing files from a hard-coded list of extensions and directories, along with sending system information and running processes to the attacker,” the Google Threat Intelligence Group (GTIG) said. The malware, the company said,…
Russian Hackers Using ClickFix Fake CAPTCHA to Deploy New LOSTKEYS Malware
The Russia-linked threat actor known as COLDRIVER has been observed distributing a new malware called LOSTKEYS as part of an espionage-focused campaign using ClickFix-like social engineering lures. "LOSTKEYS is capable of stealing files from a hard-coded list of extensions and directories, along with sending system information and running processes to the attacker," the Google Threat
Coverage Details
Bias Distribution
- 50% of the sources are Center, 50% of the sources lean Right
To view factuality data please Upgrade to Premium
Ownership
To view ownership data please Upgrade to Vantage
