COLDRIVER APT Group Uses ClickFix to Deliver New PowerShell-Based Backdoor BAITSWITCH

Russia-linked threat actors continue targeting civil society with sophisticated social engineering campaigns and lightweight malware tools in September 2025.

The campaign delivers two previously undocumented malware families: a downloader dubbed BAITSWITCH and a PowerShell-based backdoor named SIMPLEFIX.

COLDRIVER, also tracked as Star Blizzard, Callisto, and UNC4057, has historically focused on credential phishing campaigns against NGOs, think tanks, journalists, and human rights defenders in both Western countries and Russia.

The Russia-linked advanced persistent threat (APT) group COLDRIVER has expanded their attack arsenal with a new multi-stage ClickFix campaign designed to target Russian civil society members, according to recent research by Zscaler ThreatLabz.

The group’s latest campaign represents a significant evolution in their tactics, incorporating the ClickFix social engineering technique that they first adopted in early 2025.

The attack begins when victims visit a webpage masquerading as an information resource for Russian civil society members facing challenges.

The site displays a fake Cloudflare Turnstile checkbox designed to trick users into executing malicious commands. When clicked, embedded JavaScript copies a malicious rundll32.exe command to the victim’s clipboard, instructing them to paste and execute it in the Windows Run dialog box.

In this section, a detailed analysis is provided for each component of the attack chain initiated when a victim visits a ClickFix webpage and performs the actions prompted by the site. 

LOSTKEYS malware payload delivery chain using fake CAPTCHA and staged client-server communication. 

The two-page document discusses building resilience for exiled Russian civil society members through mentorship and fellowship programs, providing perfect cover for the malicious activity occurring in the background.

Multi-Stage Infection Chain

The BAITSWITCH downloader (machinerie.dll) represents a sophisticated piece of malware that establishes persistence and retrieves additional payloads.

The malware connects to command-and-control infrastructure using a hardcoded user-agent string, with servers responding only to this specific identifier to avoid detection by security researchers.

BAITSWITCH executes a carefully orchestrated five-stage process. First, it establishes persistence by modifying the UserInitMprLogonScript registry key to execute a PowerShell script at the next user logon.

Second, it stores encrypted payloads in Windows registry keys EnthusiastMod and QatItems. Third, it downloads a PowerShell stager from southprovesolutions.com and saves it to the victim’s AppData directory.

The malware then performs anti-forensics activities by clearing the RunMRU registry key, effectively erasing traces of the initial ClickFix command execution. Finally, it sends the victim’s hostname to the command-and-control server, likely registering the compromised system for future operations.

The SIMPLEFIX backdoor demonstrates COLDRIVER’s preference for lightweight, fileless malware that operates entirely in memory.

The PowerShell-based tool employs string obfuscation techniques and establishes persistence through registry manipulation, making detection challenging for traditional security tools.

Once active, SIMPLEFIX operates on a three-minute polling cycle, generating unique user-agent strings combining the computer name, username, and machine UUID for all command-and-control communications.

The backdoor supports three primary command types: binary deployment with customizable command-line parameters, system reconnaissance command execution, and PowerShell script execution with output exfiltration.

During analysis, researchers observed the malware executing comprehensive reconnaissance commands including “whoami /all,” “ipconfig /all,” “systeminfo,” and network enumeration tools.

Most concerning was a PowerShell script designed to exfiltrate information about specific file types (.pdf, .doc, .xls, .txt, .zip, .rar, .7z) from targeted directories including Documents, Downloads, Desktop, and OneDrive folders.

Russian Cyber Operations

Zscaler ThreatLabz attributes this campaign to COLDRIVER with moderate confidence based on multiple overlapping tactics, techniques, and procedures.

The ClickFix HTML page contains similarities to COLDRIVER’s January 2025 campaign materials, while the split decryption key methodology mirrors techniques used in their LOSTKEYS VBScript malware.

The reconnaissance capabilities closely match previous COLDRIVER operations, particularly the systematic enumeration of document files that could provide strategic intelligence value.

Most significantly, the campaign’s victimology aligns perfectly with COLDRIVER’s established targeting patterns, focusing on Russian civil society members, human rights defenders, and individuals connected to pro-democracy movements.

The threat group’s continued evolution demonstrates the persistent danger facing civil society organizations and dissidents.

COLDRIVER’s adoption of ClickFix techniques, combined with lightweight PowerShell-based malware, represents an effective approach that bypasses many traditional security controls while maintaining operational security.

Mitigations

Security professionals recommend implementing basic cybersecurity practices to defend against these attacks.

Organizations should enforce least privilege access controls and deploy application control technologies like Windows AppLocker or App Control to block unauthorized scripts and binaries.

Browser isolation technologies can help mitigate clipboard interactions and prevent user actions on untrusted websites from compromising systems.

Additionally, security awareness training should emphasize the risks of executing commands from clipboard content, particularly when prompted by web pages claiming to require CAPTCHA verification or technical troubleshooting steps.

The COLDRIVER campaign underscores that sophisticated nation-state actors continue targeting vulnerable communities with evolving tactics.

While the techniques employed are neither novel nor technically advanced, their effectiveness against targeted populations remains concerning for civil society organizations operating in high-risk environments.

Indicators Of Compromise (IOCs)

Type	Value	Description
Domain	preentootmist[.]org	ClickFix domain.
Domain	blintepeeste[.]org	ClickFix domain.
Domain	captchanom[.]top	Domain hosting the BAITSWITCH DLL and intermediate commands.
Domain	southprovesolutions[.]com	C2 server.
URL	hxxps://preentootmist[.]org/?uinfo_message=Resilient_Voices	ClickFix webpage posing as a Russian think tank.
URL	hxxps://blintepeeste[.]org/?u_storages=Resilient_Voices_concept	ClickFix webpage posing as a Russian think tank.
URL	hxxps://captchanom[.]top/check/machinerie.dll	URL hosting the BAITSWITCH DLL.
URL	hxxps://captchanom[.]top/coup/premier	Responds with a command to add a Windows registry key for launching the first stage of the PowerShell script.
URL	hxxps://captchanom[.]top/coup/deuxieme	Responds with a PowerShell command to add the AES-encrypted script to Windows registry.
URL	hxxps://captchanom[.]top/coup/troisieme	Responds with a PowerShell command to download the first stage of the PowerShell script.
URL	hxxps://captchanom[.]top/coup/quatre	Responds with a command to delete Windows registry key.
URL	hxxps://southprovesolutions[.]com/FvFLcsr23	Responds with the first stage of the PowerShell script.
URL	hxxps://southprovesolutions[.]com/Zxdf	Responds with the second stage of PowerShell script.
URL	hxxps://southprovesolutions[.]com/KZouoRc	C2 URL to fetch commands.
URL	hxxps://southprovesolutions[.]com/EPAWl	C2 URL used for data exfiltration.
URL	hxxps://southprovesolutions[.]com/VUkXugsYgu	URL used to confirm successful command execution on the endpoint.
URL	hxxps://drive.google.com/file/d/1UiiDBT33N7unppa4UMS4NY2oOJCM-96T/view	Google Drive URL used to host the social-engineering lure.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.