Loading malware…
YESROBOT is a minimal Python-based backdoor in the ROBOT malware suite used by the Russian state-sponsored cyber-espionage actor COLDRIVER, also tracked as Star Blizzard, Callisto, and UNC4057. It was deployed briefly in May 2025 as a follow-on payload staged by the NOROBOT downloader. The infection chain used ClickFix-style fake CAPTCHA lures to induce victims to execute malicious commands, ultimately deploying NOROBOT and a Python 3.8 environment required by YESROBOT. YESROBOT retrieves commands over HTTPS from hard-coded command-and-control infrastructure and supports downloading and executing files as well as retrieving documents of interest from compromised systems. Its command model required valid Python commands, limiting its flexibility. COLDRIVER rapidly abandoned YESROBOT in favor of the more extensible PowerShell-based MAYBEROBOT backdoor, likely in part because installing a full Python runtime was a conspicuous artifact. The toolset was assessed to support intelligence collection against high-value targets, including government, policy, NGO, academic, media, civil-society, and Ukraine-related organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
CosmicPulse télécharge deux archives ZIP : l’une contenant Python 3.8 et un bootstrapper, l’autre le payload CosmicPulse (YESROBOT).
6 distinct techniques documented for this family, organized by ATT&CK tactic.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor payload downloaded by the CosmicPulse downloader as part of the RedFlick delivery chain.
Minimal Python backdoor where operator commands must be valid Python, making common tasks (download/retrieve files) more cumbersome; part of ColdRiver’s updated toolset delivered via fake CAPTCHA/ClickFix chains.
Minimal Python backdoor that uses HTTPS to a hard-coded C2 to retrieve commands; supports downloading/executing files and retrieving documents of interest.
Short-lived Python-based backdoor stage associated with NOROBOT; required dropping a full Python 3.8 runtime on Windows, which was assessed as too noisy/obvious and subsequently replaced by MAYBEROBOT.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.