Cyberdudebivash

          From Phishing to PowerShell: A Threat Report on COLDRIVER's Shift to the Evasive BAITSWITCH Backdoor     By CyberDudeBivash • September 27, 2025 Threat Intelligence Report   The Russian state-sponsored threat actor COLDRIVER (aka Star Blizzard, SEABORGIUM) is evolving. Long known for its targeted and effective credential phishing campaigns, the group is now escalating its operations by deploying a sophisticated, fileless PowerShell backdoor known as BAITSWITCH. This marks a strategic shift from passive intelligence gathering via stolen credentials to active, hands-on-keyboard intrusions. This report provides a comprehensive analysis of the new attack chain, a technical deep-dive into the BAITSWITCH malware, and actionable guidance for threat hunters and defenders to detect and mitigate this advanced threat.   Disclosure: This threat intelligence report is based on our analysis of publicly available information fr...