MalwareUsed by 1 actor

FrostyNeighbor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UNC1151

Noticing that aspects of the above were being detected by ESET as FrostyNeighbor, we went hunting on their other detections to try to find other samples.

via strikeready blogstrikeready.com

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1608Stage CapabilitiesEvidence1

Tactic ID Name Resource Development T1583 Acquire Infrastructure T1608 Stage Capabilities

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence2

The document ( Лист мадопомога.doc ec0e4a3dcfcc85ed52783f7cf2e80ddf) was leveraging a dynamic captcha, created in a local macro, to prevent analysis.

Execution

7 techniques

T1053Scheduled Task/JobEvidence1

var taskName = "QQ Automated Workflows"; ... a0_0x2838df.Arguments = a0_0x16e3db; a0_0x225f2e.Settings.MultipleInstances = 1;

T1053.005Scheduled TaskEvidence1

Execution T1204.002 User Execution: Malicious File T1053.005 Scheduled Task/Job: Scheduled Task

T1059Command and Scripting InterpreterEvidence1

Execution T1204.002 User Execution: Malicious File T1053.005 Scheduled Task/Job: Scheduled Task T1059 Command and Scripting Interpreter

T1059.005Visual BasicEvidence1

The attacker had already achieved macro execution to run... when the captcha is correct, the string uOMeDrJtHN is being passed to unprotect the document, and the function llolo10ooll executed.

T1059.007JavaScriptEvidence1

var a0_0x16e3db = "//B //E:jscript " + String.fromCharCode(34) + programPath + ":Zone.Identifier" + String.fromCharCode(34) + " /QQEX";

T1204User ExecutionEvidence1

Figure 1: What the user sees upon opening the doc ... The document is then unprotected, the below decoy is shown, and the macro carves a dll and executes.

T1204.002Malicious FileEvidence1

53_7.03.2026_R.pdf ... Lure PDF document ... 53_7.03.2026_R.js ... JavaScript dropper

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

var taskName = "QQ Automated Workflows"; ... a0_0x2838df.Arguments = a0_0x16e3db; a0_0x225f2e.Settings.MultipleInstances = 1;

T1053.005Scheduled TaskEvidence1

Execution T1204.002 User Execution: Malicious File T1053.005 Scheduled Task/Job: Scheduled Task

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence1

var taskName = "QQ Automated Workflows"; ... a0_0x2838df.Arguments = a0_0x16e3db; a0_0x225f2e.Settings.MultipleInstances = 1;

T1053.005Scheduled TaskEvidence1

Execution T1204.002 User Execution: Malicious File T1053.005 Scheduled Task/Job: Scheduled Task

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence2

Files that leverage anti-analysis techniques can often be interesting threads to pull on... The macro in the document was constructed in the below, self-documented, code block... The rest of the obfuscation leverages 1, L, 0 and o.

T1027.009Embedded PayloadsEvidence1

T1027.009 Obfuscated Files or Information: Embedded Payloads

T1036.005Match Legitimate Resource Name or LocationEvidence1

T1036.005 Masquerading: Match Legitimate Resource Name or Location

T1218.010Regsvr32Evidence1

such as 433A5C57696E646F77735C53797374656D33325C72656773767233322E657865 (regsvr32) or 2F75202F7320 , the arguments.

T1497Virtualization/Sandbox EvasionEvidence1

The document ... was leveraging a dynamic captcha, created in a local macro, to prevent analysis... The reason we known it was to prevent detection... any roadblocks that would be thrown up, would only be to aggravate detection.

Discovery

3 techniques

T1057Process DiscoveryEvidence1

Discovery T1057 Process Discovery

T1082System Information DiscoveryEvidence1

T1082 System Information Discovery

T1497Virtualization/Sandbox EvasionEvidence1

Collection

1 technique

T1005Data from Local SystemEvidence1

var a0_0x14aa73.push("User: " + userName); ... push("\nComputer: " + computerName) ; ... push("\nSystem: " + osVersion) ; ... push("\nBooted: " + a0_0x18bb96) ;

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The carved file, EdgeService.dll 59b4add2262c4f44a3dc955893fe583d, beacons to agelessinvesting.xyz ... dropping a similar looking ... .hta ... beaconing to ... fermen.pickleandferment.top

T1105Ingress Tool TransferEvidence1

The carved file, EdgeService.dll 59b4add2262c4f44a3dc955893fe583d, beacons to agelessinvesting.xyz.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Exfiltration T1041 Exfiltration Over C2 Channel

INDICATORS OF COMPROMISE

IOCs tracked for this family

41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

14 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

25 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app4 months ago

domain●●●●●●●●●●●●View more in app5 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

strikeready blogNews

Dec 5, 2025

Captch-ya if you can | StrikeReady Blog | StrikeReady

A malware family associated here with UNC1151 phishing chains using malicious Office documents, PDFs, and HTAs. The analyzed payloads decode and execute DLL/HTA stages, establish beaconing to attacker-controlled domains, and include a data-stealing component that collects host and user information.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching41

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

FrostyNeighbor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UNC1151

Noticing that aspects of the above were being detected by ESET as FrostyNeighbor, we went hunting on their other detections to try to find other samples.

via strikeready blogstrikeready.com

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1608Stage CapabilitiesEvidence1

Tactic ID Name Resource Development T1583 Acquire Infrastructure T1608 Stage Capabilities

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence2

The document ( Лист мадопомога.doc ec0e4a3dcfcc85ed52783f7cf2e80ddf) was leveraging a dynamic captcha, created in a local macro, to prevent analysis.

Execution

7 techniques

T1053Scheduled Task/JobEvidence1

var taskName = "QQ Automated Workflows"; ... a0_0x2838df.Arguments = a0_0x16e3db; a0_0x225f2e.Settings.MultipleInstances = 1;

T1053.005Scheduled TaskEvidence1

Execution T1204.002 User Execution: Malicious File T1053.005 Scheduled Task/Job: Scheduled Task

T1059Command and Scripting InterpreterEvidence1

Execution T1204.002 User Execution: Malicious File T1053.005 Scheduled Task/Job: Scheduled Task T1059 Command and Scripting Interpreter

T1059.005Visual BasicEvidence1

The attacker had already achieved macro execution to run... when the captcha is correct, the string uOMeDrJtHN is being passed to unprotect the document, and the function llolo10ooll executed.

T1059.007JavaScriptEvidence1

var a0_0x16e3db = "//B //E:jscript " + String.fromCharCode(34) + programPath + ":Zone.Identifier" + String.fromCharCode(34) + " /QQEX";

T1204User ExecutionEvidence1

Figure 1: What the user sees upon opening the doc ... The document is then unprotected, the below decoy is shown, and the macro carves a dll and executes.

T1204.002Malicious FileEvidence1

53_7.03.2026_R.pdf ... Lure PDF document ... 53_7.03.2026_R.js ... JavaScript dropper

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

var taskName = "QQ Automated Workflows"; ... a0_0x2838df.Arguments = a0_0x16e3db; a0_0x225f2e.Settings.MultipleInstances = 1;

T1053.005Scheduled TaskEvidence1

Execution T1204.002 User Execution: Malicious File T1053.005 Scheduled Task/Job: Scheduled Task

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence1

var taskName = "QQ Automated Workflows"; ... a0_0x2838df.Arguments = a0_0x16e3db; a0_0x225f2e.Settings.MultipleInstances = 1;

T1053.005Scheduled TaskEvidence1

Execution T1204.002 User Execution: Malicious File T1053.005 Scheduled Task/Job: Scheduled Task

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence2

T1027.009Embedded PayloadsEvidence1

T1027.009 Obfuscated Files or Information: Embedded Payloads

T1036.005Match Legitimate Resource Name or LocationEvidence1

T1036.005 Masquerading: Match Legitimate Resource Name or Location

T1218.010Regsvr32Evidence1

such as 433A5C57696E646F77735C53797374656D33325C72656773767233322E657865 (regsvr32) or 2F75202F7320 , the arguments.

T1497Virtualization/Sandbox EvasionEvidence1

Discovery

3 techniques

T1057Process DiscoveryEvidence1

Discovery T1057 Process Discovery

T1082System Information DiscoveryEvidence1

T1082 System Information Discovery

T1497Virtualization/Sandbox EvasionEvidence1

Collection

1 technique

T1005Data from Local SystemEvidence1

var a0_0x14aa73.push("User: " + userName); ... push("\nComputer: " + computerName) ; ... push("\nSystem: " + osVersion) ; ... push("\nBooted: " + a0_0x18bb96) ;

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The carved file, EdgeService.dll 59b4add2262c4f44a3dc955893fe583d, beacons to agelessinvesting.xyz ... dropping a similar looking ... .hta ... beaconing to ... fermen.pickleandferment.top

T1105Ingress Tool TransferEvidence1

The carved file, EdgeService.dll 59b4add2262c4f44a3dc955893fe583d, beacons to agelessinvesting.xyz.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Exfiltration T1041 Exfiltration Over C2 Channel

INDICATORS OF COMPROMISE

IOCs tracked for this family

41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

14 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

25 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app4 months ago

domain●●●●●●●●●●●●View more in app5 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

strikeready blogNews

Dec 5, 2025

Captch-ya if you can | StrikeReady Blog | StrikeReady

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching41

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.