CyberWire Daily - Cold lures, hot targets. [Research Saturday]

Episode Date: July 25, 2026

This week, we are joined by Ondrej Kubovič, Security Awareness Specialist from ESET, discussing their work on "FrostyNeighbor: Fresh mischief and digital shenanigans." Ondrej walks us through ESET's latest research into FrostyNeighbor, a long-running Belarus-aligned cyberespionage group that has continued to target Ukrainian government organizations with increasingly sophisticated spearphishing campaigns. We discuss how the group uses malicious PDF lures, server-side victim validation, and an updated JavaScript-based malware chain to selectively deploy espionage tools, demonstrating its ongoing efforts to evade detection while compromising high-value targets across Eastern Europe. The research and executive brief can be found here: ⁠FrostyNeighbor: Fresh mischief and digital shenanigans

You're listening to the Cyberwire Network, powered by N2K. If you're heading to Black Hat USA this year, make plans to visit the Spector Ops Kennel Club. As creators of Bloodhound, the SpectorOps team will host talks with OpenAI and the UK AI Security Institute, as well as hands-on workshops aimed at helping you understand AI accelerated attack paths and the latest in identity tradecraft. Visit Spectorops.io to pre-execorops.io to provide. pre-register and learn more. Spector Ops Kennel Club is adjacent to Libertine Social inside Mandalay Bay. While you're there, visit the N2K Cyberwire podcast studio,

where we'll be capturing expert perspectives and conversations from across Blackhead. Hello, everyone, and welcome to the Cyberwires Research Saturday. I'm Dave Bittner, and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard. problems and protecting ourselves in a rapidly evolving cyberspace. Thanks for joining us. So what we can say, their goals are aligned with Belarus. They are active since at least 2016, and their primary targets in the area they are

focusing on geographically is typically around Belarus, which is also playing into that alignment that I have been mentioning before. and they are targeting Poland, Lithuania and Ukraine the most, but we have seen also other countries in Europe. That's Andrei Kovovic, security awareness specialist from ESET. The research we're discussing today is titled Frosty Neighbor, Fresh Mischief and Digital Shenanigans. And what does it seem like they're after here? Are they financially motivated or after, is it an espionage motivation?

It's definitely espionage motivation. and they are looking at different sectors based on the country that they are targeting because in Ukraine we see they are mostly after military defense governmental stuff. And in Poland and Lithuania and some of the other European countries, it was also some maybe more opportunistic stuff such as manufacturing, healthcare, pharma, even logistics. So of course governmental is always in the mix if there is the opportunity, but also other sectors that were not seen in Ukraine.

Well, let's walk through the attack chain together here. How would someone find themselves targeted here and then what would happen next? So the first main condition in this campaign that we documented was that you are from Ukraine because the whole chain doesn't work if they are doing this check. You receive a spherefishing email that has a PDF attached. you open it and instead of showing you the PDF it's some blurry version of it and you need to click on something so that you get the full visible readable version now before that happens when you click the thing is there is a geographical check if your IP is Ukrainian or any type of selected region because maybe they are interested in specific regions in Ukraine it will not give you the content it will show you

the same Decoy PDF as you would see when you are targeted, but the malicious stuff in the background is not happening. So that's the main thing that they are doing in the beginning. So that's the first check. But if it's correct, if your IP is from Ukraine, it downloads a RAR file, so an archive that will drop a JavaScript. And that JavaScript is basically the first or maybe, let's say, second stage of attack, and that's Picasso Loader, which is actually something that we know to be a tooling of this group. So this is something that they have been developing and working on for years now. Well, Picasso Loader has an interesting history here. What can you tell us about that? We have seen it actually on several campaigns. It has been first documented by the Ukrainian

cert, and they have given it this name because Picasso Loader, as the name suggests, has some connection with pictures. It's actually because it's trying to, it'll look like it's downloading a renderable image. Now that, I was actually very curious about this and asking this with the researchers and what I've been told, it's not a specific topic of these pictures. So don't imagine something that is going to be very catchy for the eye. It's random. So we have seen games, we have seen drones, we have seen different topics of these pictures. And it wasn't AI general. which is also something maybe interesting today that we see. And yeah, I mean, the fact is that they are using this Picasso loader to get to the final stage

to the final payload and that final payload is Cobalt Strike, which is a known tooling for red teamers. Now, Frosty Neighbor, they have this reputation for keeping their tooling up to date for updates along the way. What's the importance of that for a threat actor who's out there trying to do long-term espionage? The main thing is if your tooling is documented and well documented, the problem is that it gets detected. So you need to work on your evasion techniques. You need to figure out the way, how to sidestep the detection. So of course, that's what's behind the update cycle. then you need to run.

And of course, you are also trying to avoid being spotted during the operation because cyber espionage is stealthy by design. So that's what they are trying to achieve by changing their tooling as much as possible. We have seen this, of course, with any sophisticated actor that they are trying to figure out ways how to stay under the radar. And as I say, the updates are one of the ways how to do it. They seem to be pretty careful about validating their victims before they deliver that final payload.

Tell us about this group's operational discipline? So there are two, except for the check for the geography. There are also two other things that they are doing during the attack chain. First one is that the victim's computer is fingerprinted every 10 minutes. I mean, it's getting a lot of information on the victim, including username, computer name, even the current time, so that they know where the victim is. actually is located and of course stuff like process IDs so that they can see what's running on the machine and that information is then reported to the command and control server and only victims that

are probably manually decided by the operators actually get the final payload of a cobalt strike so they are actually running let's say a level of automated checks and then the final decision sits probably with the operator we'll be right back AI is making fishing attacks faster, more convincing, and harder for people to spot, and traditional security awareness and fishing training weren't designed for this level of attack. Hawkshunt helped security teams prepare employees for the attacks they face every day, with personalized fishing training that adapts to each employee and reduces risky behavior over time. For IT and security leaders looking to strengthen their human layer of defense,

without adding more manual work, visit hoxhunt.com slash cyberwire to learn more. That's h-o-x-h-U-N-T dot com slash cyberwire. Now, from the victim's perspective, what does an attack look like? As I said, you receive a spearfishing email that has the PDF attached. The PDF shows you the decoy and drops second stage and third stage of the attack. And in the end, when you're infected by Cobalt Strike, what happens is that they can, they get effectively access to your device and basically full control,

because that's what the red steaming tools are allowing you to. So that's what they are trying to achieve. And for you, most of that chain is, of course, invisible, because, again, espionage needs to be as stealthy as possible. So in the end, when you're infected, the information is being pilfered out of your machine and sent to the CNC of the attackers. And for you, you saw the document, so that's basically what it ends for you.

Were there any technical details in this campaign that you and your colleagues found particularly interesting or maybe even surprising? I mean, even the fact that there has been an update cycle to this whole thing is interesting, because we see that they are continuously active, developing their tooling, trying to evade detection. implementing these checks that's also something that can be of interest and they were also trying to achieve persistence so they're modifying registries to run the malware at every startup

and trying to use a Viber as cover so the desktop version of the communication app as cover so I would say some of those things might be interesting it depends on the the beauty is in the eye of the beholder so there are several things that could catch your attention. Yeah.

What does this campaign say about the current state of things in Eastern Europe? Is this the typical type of thing that researchers see in that part of the world? I would say to a level, yes, because we have seen similar techniques that they have been using in the past campaigns, but even in this one also being used by Russia-aligned actors. I'm not saying the same one. For example, we have seen a very similar tactic being used, but exploiting a specific CVE, and it was trying to abuse RoundCube,

which is a quite popular webmail application. And what they were trying to achieve was to attack the victim during the email opening phase. So when you open the email, they are trying to, harvest your credentials and use that to spy on you and get information from your emails. We have seen similar campaign or similar approach by other actors in the region, but they were using a different CVE, which again probably shows that these guys are technically very capable and showing that they know how to run similar campaigns.

Yeah, I mean, it strikes me that this seems to be a fairly sophisticated, group. Is that a fair assessment? Yes, yes, that's a fair assessment because we have seen different approaches deployed in their attacks. For example, we can say that the main downloader, the Picasso loader, has multiple variants, so they are quite capable with different languages. Dotnet, PowerShell, JavaScript, this case was JavaScript, the recent one, C++, so they are capable of rewriting and updating the tooling in different languages. They are also capable of abusing known vulnerabilities and finding ways how to abuse them for their own campaigns. And again, they seem to be also

quite fluid in what's being used, what's quite what makes them invisible in the targeted environment. So, for example, they are trying to also blend in with the web traffic that we typically see, so some web-associate file types they are abusing because your computer is typically processing a lot of those during the day, so this blends in with the traffic and it's quite complicated for you to detect. So yes, they seem to be quite technically skilled. Swinging back around, you mentioned that the final payload is Cobalt Strike. For folks who may not be familiar with that, how do you describe that? It's a legitimate security tool, which is typically used by pen-testers and professionals in cybersecurity, to test how good your defenses are if there is anything vulnerable in your environment.

And using that tool gives you all the touch. You can try to touch different parts of your system and figure out what's wrong. Of course, if this falls in the wrong hands or if that type of tool can be dropped on a system, it gives you. you quite a powerful framework or tool in your hands which you can use for remote access and some serious intrusion. What are your recommendations for the defenders in our audience to protect themselves against this sort of thing? So I'll start at the basics. As I mentioned, there were some CVEs and stuff that's being abused.

So of course, patching your systems is something that will always go a long way. In this case, you would have to be capable of actually seeing that communication with the server, but based on threat intelligence, you can actually detect for that, and block dropping of those second and third stages of this attack. And of course, Cobalt Strike, when it's active, it has some communication that's going to the servers of the attackers. So again, something that can be detected, the network communication. So all of this can be quite helpful for a skilled defender to block and detect.

Our thanks to Andre Kobovic from ESET for joining us. The research is titled Frosty Neighbor, Fresh Mischief and Digital Shenanigans. We'll have a link in the show notes. And that's Research Saturday. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that you. keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the

show notes or send an email to Cyberwire at N2K.com. This episode is produced by Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here next time. Heading to Black Hat USA, the N2K's Cyberwire team will be on-site recording from our podcast studio in the SpectorOps Kennel Club. If you're interested in joining us for a conversation or learning more about what we're recording throughout the week, stop by the studio and meet the N2K Cyberwire team. SpectorOps's Kennel Club is adjacent to Libertine Social inside Mandalay Bay.