NOROBOT
COLDRIVER downloader malware, delivered through ClickFix-style lures, tracked by Google.
Microsoft said in September 2026 that Star Blizzard, the FSB unit Google calls COLDRIVER, had targeted more than 100 organisations with fake event invitations. NOROBOT is the downloader Google says the group adopted five days after its LOSTKEYS malware was exposed in May 2025.
Last refreshed: 12 October 2026
How fast did Russia's COLDRIVER replace its malware after exposure?
Timeline for NOROBOT
Mentioned in: Star Blizzard lures think tanks by invite
Cybersecurity: Threats and DefencesBackground
NOROBOT is a malicious DLL that Google Threat Intelligence Group (GTIG) attributes to COLDRIVER, the Russian group also tracked as Star Blizzard and Callisto. GTIG says COLDRIVER brought it into use five days after its earlier malware, LOSTKEYS, was publicly exposed in May 2025.
Victims met NOROBOT through COLDCOPY, a fake CAPTCHA page in the ClickFix style that talked users into running the DLL with rundll32. The chain at first ended in YESROBOT, a Python backdoor, and later in MAYBEROBOT, a PowerShell backdoor. GTIG says COLDRIVER kept reworking the sequence to stay ahead of those tracking it.
COLDRIVER was also behind the think-tank event invitations that Microsoft described in September 2026, when it linked at least 13 phishing waves that year to Star Blizzard.