Spica

Spica is a custom malware developed and utilized by the threat group known as Coldriver. The backdoor software, Spica, was first identified by Google's Threat Analysis Group (TAG), which has been tracking its use since as early as September of the previous year. The malware appears to be used in highly targeted attacks and is likely still under active development. It provides persistent access to a victim's machine, enabling the execution of commands, theft of browser cookies, and exfiltration of documents. Despite law enforcement action, Cold River's activity has remained consistent over the years. The functionality of Spica allows attackers to execute commands on targeted systems, upload and download files, and gather system and file information. A particular command named "telegram" is embedded within Spica, although its exact function remains unclear. Google believes that multiple versions of the Spica backdoor exist, each featuring a different embedded decoy document to match the lure document sent to targets. The earliest use of this backdoor by Coldriver dates back to November 2022. Google’s TAG has created a YARA rule to assist in identifying the Spica backdoor. The rule includes various strings and conditions related to the malware, such as "os_win.c:%d: (%lu) %s(%s) – %s", "winWrite1", "DNS resolution panicked", and "struct Dox". These identifiers can help in detecting the presence of Spica in a system. Notably, one of the strings is “Card Holder: Bull Gayts”, suggesting a possible attempt at humor or misdirection by the malware's creators.