Loading malware…
OYSTERBLUES is an information-stealing malware component used in a multi-stage intrusion chain attributed by CERT-UA to the Belarus-aligned threat actor UNC1151, also known as Ghostwriter and UAC-0057. The campaign targeted Ukrainian government organizations beginning in spring 2026 and used spear-phishing emails sent from compromised accounts, themed around the legitimate Prometheus online learning platform. Victims were lured via PDF attachments containing links to ZIP archives that delivered a JavaScript component named OYSTERFRESH. OYSTERFRESH displayed a decoy document, stored an obfuscated or encoded OYSTERBLUES payload in the Windows Registry, and downloaded and launched OYSTERSHUCK, which decoded OYSTERBLUES using techniques including string reversal, ROT13 transformation, and URL decoding.
Once executed, OYSTERBLUES profiles the compromised Windows host by collecting the computer name, username, operating system version, last OS boot time, and a list of running processes. It exfiltrates this reconnaissance data to a command-and-control server via HTTP POST, then waits for follow-on JavaScript instructions from the server and executes them using the eval() function. Reporting states that the infection chain ultimately deployed or could deploy Cobalt Strike in later stages. CERT-UA also noted that the attacker infrastructure was commonly hidden behind Cloudflare and that many associated domains used the .icu top-level domain.
High-confidence host and network indicators mentioned in the reporting include the file name Oyster.js for OYSTERBLUES; related components certificate.js (OYSTERFRESH), amplifier.js (OYSTERSHUCK), and EdgeSystemConfig.dll (CSBEACON/Cobalt Strike Beacon); the registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Blue'Oyster'; persistence via Run keys 'MicrosoftEdgeUpdate' and 'WindowsEdgeStartup'; the scheduled task MicrosoftEdgeUpdateTaskMachine; and network indicators including hXXps://a3ufz.xsjdsb[.]icu/wp-json/prometheus-plus/certs-at-home/downloads, mickeymousegamesdealer.alexavegas[.]icu, productionsamplesoftheyear.cgdirector[.]icu, and advancedaisolutionsforeveryone.a1si[.]icu.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Late last month, the Computer Emergency Response Team of Ukraine (CERT-UA) attributed to the Belarus-aligned threat actor known as UNC1151 (aka Ghostwriter and UAC-0057) a spear-phishing campaign that targeted government organizations using compromised accounts to deliver an information stealer called OYSTERBLUES.
The malware chain ultimately deployed components known as OysterBlues and OysterShuck, which collect system information from infected devices and send it to attacker-controlled infrastructure hidden behind Cloudflare.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Late last month, the Computer Emergency Response Team of Ukraine (CERT-UA) attributed to the Belarus-aligned threat actor known as UNC1151 (aka Ghostwriter and UAC-0057) a spear-phishing campaign that targeted government organizations using compromised accounts to deliver an information stealer called OYSTERBLUES.
Late last month, the Computer Emergency Response Team of Ukraine (CERT-UA) attributed to the Belarus-aligned threat actor known as UNC1151 (aka Ghostwriter and UAC-0057) a spear-phishing campaign that targeted government organizations using compromised accounts to deliver an information stealer called OYSTERBLUES.
Ghostwriter targeted Ukrainian government agencies with phishing emails delivering malware and Cobalt Strike payloads... phishing emails sent from already-compromised accounts — making the sender look legitimate — carrying PDF attachments.
It then waits for instructions, which arrive as JavaScript code executed on the fly using the eval() function.
The mentioned JS file is classified as OYSTERFRESH... OYSTERBLUES... waits for instructions, which arrive as JavaScript code executed on the fly using the eval() function.
This file, dubbed OYSTERFRESH, displays a decoy document while stealthily writing an obfuscated payload, OYSTERBLUES, to the Windows Registry.
OYSTERFRESH... provides display of a decoy document, entry into the operating system registry in an obfuscated and encoded form of the OYSTERBLUES software tool.
OYSTERFRESH... provides display of a decoy document, entry into the operating system registry in an obfuscated and encoded form of the OYSTERBLUES software tool.
...while stealthily writing an obfuscated and encrypted payload called OYSTERBLUES to the Windows Registry...
This file, dubbed OYSTERFRESH, displays a decoy document while stealthily writing an obfuscated payload, OYSTERBLUES, to the Windows Registry.
CERT-UA said the malware gathers details including the computer name, operating system version, user account information, and running processes.
Once running, it profiles the compromised system, grabbing computer name, username, OS version, last boot time, and a list of running processes.
Once running, it profiles the compromised system, grabbing computer name, username, OS version, last boot time, and a list of running processes.
send it to attacker-controlled infrastructure hidden behind Cloudflare
and ships everything to a command-and-control server via HTTP POST.
...а також завантаження і запуск компонента OYSTERSHUCK... Відомо, що на наступному етапі на комп’ютер може бути довантажено компонент фреймворку Cobalt Strike.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.