US EditionGoogle identifies new malware linked to Russia-based hacking group
- On May 7, 2025, Google announced the discovery of a new malware named LOSTKEYS, associated with Cold River, a hacking group linked to Russia.
- Cold River, monitored since at least 2022 and associated with Russia's FSB, focuses on gathering intelligence from prominent Western figures.
- LOSTKEYS steals files from hard-coded directories, sends system information and running processes, and is deployed selectively in multi-stage social engineering attacks.
- Google researcher Wesley Shields called LOSTKEYS a new development in Cold River's toolkit, which also uses credential phishing and malware like SPICA.
- The discovery aids enhanced threat detection and user protection, with Google sharing indicators of compromise and urging users to enable advanced security measures.
18 Articles
18 Articles
Google links new LostKeys data theft malware to Russian cyberspies
Since the start of the year, the Russian state-backed ColdRiver hacking group has been using new LostKeys malware to steal files in espionage attacks targeting Western governments, journalists, think tanks, and non-governmental organizations.
Google identifies new malware linked to Russian hackers: ‘New development in the toolset’
Alphabet's Google said on Wednesday it has identified new malware called "LOSTKEYS" tied to the Russian-based hacking group Cold River, which is capable of stealing files and sending system information to attackers.
Channel News Asia
The Straits TimesGoogle identifies new malware linked to Russia-based hacking group
Alphabet's Google said on Wednesday it has identified new malware called "LOSTKEYS" tied to the Russian-based hacking group Cold River, which is capable of stealing files and sending system information to attackers.The malware "marks a new development in the toolset" of Cold River, Wesley Shields, a researche
From Russia with doubt: Go library’s Kremlin ties stoke fear (The Register) | ResearchBuzz: Firehose
The Register: From Russia with doubt: Go library’s Kremlin ties stoke fear . “Easyjson, a software library for serializing data in Golang applications, is maintained by developers affiliated with Russia’s VK Group. And this, according to security biz Hunted Labs, presents a potential security risk for US government organizations and private sector firms. Hunted said it takes this position because VK Group is allegedly controlled by Russian state…
Coverage Details
Bias Distribution
- 50% of the sources are Center, 50% of the sources lean Right
To view factuality data please Upgrade to Premium
Ownership
To view ownership data please Upgrade to Vantage
