{"id":128786,"date":"2025-05-07T19:16:13","date_gmt":"2025-05-07T19:16:13","guid":{"rendered":"http:\/\/cryptospotters.net\/?p=128786"},"modified":"2025-05-07T19:16:13","modified_gmt":"2025-05-07T19:16:13","slug":"coldriver-using-new-malware-to-steal-from-western-targets-google","status":"publish","type":"post","link":"http:\/\/cryptospotters.net\/?p=128786","title":{"rendered":"COLDRIVER using new malware to steal from Western targets \u2014 Google"},"content":{"rendered":"<p>Source: Cointelegraph.com NewsThreat group COLDRIVER is using new malware to steal documents from Western targets, according to a May 7 report from Google Threat Intelligence. The malware, called LOSTKEYS, shows the evolution of the group from credential phishing to more sophisticated attacks.<br \/>\nAccording to the Google report, the new malware is installed through four steps. The process involves a \u201clure website\u201d with a fake CAPTCHA, a PowerShell script downloaded to the user\u2019s clipboard, some device evasion, and retrieval of the final payload. Lastly, the malware is installed.<br \/>\nLOSTKEYS payload delivery. Source: GoogleLOSTKEYS is capable of stealing files from extensions and directories. It can also send system information and running processes back to COLDRIVER. The address from which the parts of the attack come is \u201c165.227.148[.]68\u201d according to Google.<br \/>\nThe company says it has already taken steps to mitigate any damage the LOSTKEYS malware will cause, including adding the malicious websites to the company\u2019s \u201cSafe Browsing\u201d feature.<br \/>\nAccording to Google, COLDRIVER is a Russian-backed threat group that typically engages in phishing attempts at high-profile Western targets, such as former diplomats, and journalists. In January 2024, it started an attack with a malware called \u201cSpica,\u201d which can execute arbitrary shell commands and download or upload software.<br \/>\nRelated: Crypto drainers now sold as easy-to-use malware at IT industry fairs<br \/>\nCrypto hack losses hit all-time high in 2025<br \/>\nCrypto hacks have surged in 2025, with total losses reaching $2 billion in the first quarter alone \u2014 exceeding all losses recorded in 2024.<br \/>\nAccording to a report by crypto cybersecurity firm Hacken, operational flaws and weak access controls remain key vulnerabilities \u2014 even among major centralized and decentralized players. Attackers are also increasingly using social engineering tactics to gain victims\u2019 trust.<br \/>\nContributing to last quarter&#8217;s losses was the $1.5 billion hack of cryptocurrency exchange Bybit. The February attack was reportedly orchestrated by the Lazarus Group.<br \/>\nMagazine: Lazarus Group\u2019s favorite exploit revealed \u2014 Crypto hacks analysis<a href=\"https:\/\/cointelegraph.com\/news\/coldriver-new-malware-steal-western-targets-google?utm_source=rss_feed&amp;utm_medium=rss&amp;utm_campaign=rss_partner_inbound\" target=\"_blank\" class=\"feedzy-rss-link-icon\" rel=\"noopener\">Read More<\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>Source: Cointelegraph.com NewsThreat group COLDRIVER is using new malware to steal documents from Western targets, according to a May 7 report from Google Threat Intelligence. The malware, called LOSTKEYS, shows&hellip; <\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"_links":{"self":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/posts\/128786"}],"collection":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=128786"}],"version-history":[{"count":0,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/posts\/128786\/revisions"}],"wp:attachment":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=128786"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=128786"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=128786"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}