ColdRiver Russian Hackers: New Spica Backdoor Malware Uses Payloads to Disguise as PDF Decryption Tool Google researchers discovered that a new Spica backdoor malware is currently used in phishing by the notorious ColdRiver hackers, which is believed to be state-sponsored by the Russian government. by Joseph Henry