FrostyNeighbor Cyberespionage Campaign Targets Ukrainian and Polish Governments

Welivesecurity

FrostyNeighbor Cyberespionage Campaign Targets Ukrainian and Polish Governments

First seen 14 May 2026, 16:08 UTC • •75.6

Article Content

1 / 10

Browse articles

ThreatCluster •May 15, 2026 at 15:45 UTC

•FrostyNeighbor targets Ukrainian and Polish government organizations using spearphishing.
•The group employs a JavaScript variant of PicassoLoader to deliver Cobalt Strike payloads.
•Victim systems are fingerprinted to selectively deploy malware based on geographic location.

The Belarus-aligned cyber group FrostyNeighbor has launched a targeted campaign against government organizations in Ukraine and Poland since March 2026. Utilizing spearphishing techniques, the group delivers malicious payloads through deceptive PDF documents impersonating the Ukrainian telecom provider Ukrtelecom. The attack employs a JavaScript variant of PicassoLoader to facilitate the deployment of Cobalt Strike for post-compromise operations. FrostyNeighbor's tactics include fingerprinting victims' systems to selectively deliver malware based on geographic location, with a focus on military and governmental entities. The group has been active since at least 2016 and continues to evolve its methods to evade detection. Key vulnerabilities exploited include CVE-2024 and CVE-2023-38831. The ongoing threat poses significant risks to national security in the region.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 147d ago How this analysis works

Timeline

2026-03-01

FrostyNeighbor campaign begins

The group initiates a targeted cyberespionage campaign against Ukrainian and Polish government entities.

2026-05-14

ESET reports on new FrostyNeighbor activities

ESET uncovers updated tactics and tools used by FrostyNeighbor, including malicious PDFs and PicassoLoader.

2026-05-14

FrostyNeighbor exploits CVE-2023-38831

The group is reported to have exploited a vulnerability in WinRAR to facilitate attacks.

2026-05-14

FrostyNeighbor's tactics evolve

The group abandons macro-based lures for blurry PDFs containing malicious links, enhancing evasion techniques.

More articles in this cluster (9)

Threat Graph

15 entities, 48 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (5)

FrostyNeighbor
Pushcha
Storm-0257
TA445
UNC1151

Technique (6)

Malware
Phishing
T1059.007 - JavaScript
T1082 - System Information Discovery
T1566.001 - Spearphishing Attachment
T1566.002 - Spearphishing Link

Campaign (1)

Ghostwriter

Organization (1)

Ukrtelecom

Malware (1)

Cobalt Strike

Tool (1)

PicassoLoader

Relationships

FrostyNeighbor uses Cobalt Strike
Pushcha uses Cobalt Strike
Storm-0257 uses Cobalt Strike
TA445 uses Cobalt Strike
UNC1151 uses Cobalt Strike
FrostyNeighbor uses PicassoLoader
Pushcha uses PicassoLoader
Storm-0257 uses PicassoLoader
TA445 uses PicassoLoader
UNC1151 uses PicassoLoader
FrostyNeighbor uses Malware
FrostyNeighbor uses Phishing
FrostyNeighbor uses T1059.007 - JavaScript
FrostyNeighbor uses T1082 - System Information Discovery
FrostyNeighbor uses T1566.001 - Spearphishing Attachment
Pushcha uses Malware
Pushcha uses Phishing
Pushcha uses T1059.007 - JavaScript
Pushcha uses T1082 - System Information Discovery
Pushcha uses T1566.001 - Spearphishing Attachment
Storm-0257 uses Malware
Storm-0257 uses Phishing
Storm-0257 uses T1059.007 - JavaScript
Storm-0257 uses T1082 - System Information Discovery
Storm-0257 uses T1566.001 - Spearphishing Attachment
TA445 uses Malware
TA445 uses Phishing
TA445 uses T1059.007 - JavaScript
TA445 uses T1082 - System Information Discovery
TA445 uses T1566.001 - Spearphishing Attachment
UNC1151 uses Malware
UNC1151 uses Phishing
UNC1151 uses T1059.007 - JavaScript
UNC1151 uses T1082 - System Information Discovery
UNC1151 uses T1566.001 - Spearphishing Attachment
Ghostwriter attributed to FrostyNeighbor
Ghostwriter attributed to Pushcha
Ghostwriter attributed to Storm-0257
Ghostwriter attributed to TA445
Ghostwriter attributed to UNC1151
Ghostwriter uses Cobalt Strike
FrostyNeighbor targets Ukrtelecom
Pushcha targets Ukrtelecom
Storm-0257 targets Ukrtelecom
TA445 targets Ukrtelecom
UNC1151 targets Ukrtelecom
Cobalt Strike targets Ukrtelecom
FrostyNeighbor related to T1566.002 - Spearphishing Link

Following this threat?

Track FrostyNeighbor, Cobalt Strike and Ukrtelecom in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

FamousSparrow Deploys SparroWocky Backdoor in Latin America The China-aligned cyberespionage group FamousSparrow has replaced its previous backdoor, SparrowDoor, with a new malware called SparroWocky, targeting governmental organizations in Latin America since August 2025. ESET Research attributes this campaign to a likely response to increased U.S. interests in the region.…

Emerging EDR Killer Tool Targeting Ransomware Groups A new malicious tool, referred to as the EDR killer, is being actively used by at least eight ransomware groups, including Blacksuit and Medusa, to disable endpoint detection and response (EDR) solutions. This tool is believed to be an evolution of the EDRKillShifter developed by RansomHub, which allows ransomware…