{"id":55119,"date":"2024-01-18T15:15:10","date_gmt":"2024-01-18T15:15:10","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/35414\/Google-TAG-Kremlin-Cyber-Spies-Move-Into-Malware-With-Custom-Backdoor.html"},"modified":"2024-01-18T15:15:10","modified_gmt":"2024-01-18T15:15:10","slug":"google-tag-kremlin-cyber-spies-move-into-malware-with-custom-backdoor","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/google-tag-kremlin-cyber-spies-move-into-malware-with-custom-backdoor\/","title":{"rendered":"Google TAG: Kremlin Cyber Spies Move Into Malware With Custom Backdoor"},"content":{"rendered":"

Russian cyberspies linked to the Kremlin’s Federal Security Service (FSB) are moving beyond their usual credential phishing antics and have developed a custom backdoor that they started delivering via email as far back as November 2022, according to Google’s Threat Analysis Group.<\/p>\n

TAG tracks this crew as COLDRIVER, while other threat hunters call the government-backed gang Star Blizzard, UNC4057 and Callisto. The gang has been active since at least 2019, and historically targets academia, the military, governmental orgs, NGOs, think tanks, and politicians in US, the UK and other NATO countries. <\/p>\n

Since Russia invaded its neighbor<\/a> in February 2022, COLDRIVER has also stepped up its snooping activities against Ukraine’s military and defense targets as well as those of other Eastern European nations.<\/p>\n