H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Spica](https://attack.mitre.org/software/S1140) is a custom backdoor written in Rust that has been used by [Star Blizzard](https://attack.mitre.org/groups/G1033) since at least 2023.(Citation: Google TAG COLDRIVER January 2024)

Labels

malware

10 recorded

Relationships

uses

to Archive Collected Data

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Masquerade Task or Service

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to PowerShell

Technique

uses

to Scheduled Task

Technique

uses

to Steal Web Session Cookie

Technique

uses

from Star Blizzard

Group

2 external

References

mitre-attack

S1140

open

Google TAG COLDRIVER January 2024

https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/

open