Executive Summary
FrostyNeighbor, a persistent cyberespionage actor allegedly aligned with Belarus, has launched a new campaign targeting governmental, military, and critical infrastructure sectors in Eastern Europe, primarily Ukraine. Since March 2026, the group has evolved its tactics to include a multi-stage JavaScript-based infection chain that utilizes server-side validation to ensure only targeted geographic locations receive malicious payloads.
The attack chain typically begins with spearphishing emails containing malicious PDFs that lead to the execution of PicassoLoader. This downloader subsequently retrieves Cobalt Strike beacons disguised as legitimate files or web resources. The group has also been observed exploiting vulnerabilities such as CVE-2023-38831 (WinRAR) and CVE-2024-42009 (Roundcube) to facilitate credential theft and initial access, highlighting a high level of operational maturity.
FrostyNeighbor remains a critical threat to regional stability, focusing on strategic intelligence collection and influence operations (Ghostwriter). Organizations in Ukraine, Poland, and Lithuania should maintain heightened vigilance against spearphishing and implement robust monitoring for abnormal JavaScript execution and scheduled task creation.