Google says the ColdRiver Russian-backed hacking group is pushing previously unknown backdoor malware using payloads masquerading as a PDF decryption tool.
The attackers send PDF documents that seem to be encrypted via phishing emails impersonating individuals affiliated with their targets (a tactic first observed in November 2022).
When the recipients reply that they can't read the 'encrypted' documents, they're sent a link to download what looks like a PDF decryptor executable (named Proton-decrypter.exe) to view the contents of the lure documents.
"COLDRIVER presents these documents as a new op-ed or other type of article that the impersonation account is looking to publish, asking for feedback from the target. When the user opens the benign PDF, the text appears encrypted,"
Google TAG said.
However, even though this fake decryption software will display a decoy PDF document, it will backdoor the victims' devices using a malware strain dubbed Spica by security researchers with Google's Threat Analysis Group (TAG), who spotted the attacks.
