Google has discovered a new Russian virus that breaks politicians and activists: how they get infected

Cyberfachivtsi wrote that it was a harmful code created by the Russian hacker group Coldriver, which is also hidden by UNC4057, Star Blizzard and Callis. When the virus infects the system, in the easiest case, it receives access to the user's personal data - to his contacts. In addition, there were cases, the codes of the Russians received access to the file system, explained in the blog. Cases were found three times in 2025: in January, March and April.

The victims of NATO Member States and Ukraine, public organizations, former intelligence staff and diplomats, were victims of NATO and Ukraine. "We believe that the main purpose of Coldriver operations is to collect reconnaissance data to support Russia's strategic interests. In a small number of cases, the group was associated with the leakage of information against officials of UK and a non -governmental organization," the cyberfactors say.

Google has warned that Coldriver's goal is to access target contacts and files on your hard disk. Google's blog explains how the infection occurs. It is emphasized that the hackers of the Russian Federation use fake CAPTCHA, and pieces of harmful code can "pretend" that they are parts of the OSINT program to collect Maltego data. How is the LOSTKEYS virus infection: the company also explained how it will protect against the virus. These are people who can become goals for Russian hackers.

They offer three options for protection. First, register in the Extended Protection Program. Secondly, enable the improved safe view of Google. Third, update the programs on the devices. It should be noted that in September 2024, the US Department of Justice told about Russian hackers, who are promised $ 10 million for "heads". The Ministry said it was about three GUR officers who staged a cyberattack on computers of the Government of Ukraine a few days before the invasion in 2022.