Loading story…
A financially motivated cybercrime group has launched Operation FrostBeacon, a sophisticated malware campaign targeting business-to-business (B2B) enterprises across the Russian Federation. The attackers use a dual infection strategy: one method involves phishing emails containing archive files with malicious LNK shortcuts disguised as PDF documents, which, when executed, trigger hidden PowerShell commands to download further payloads. The second method exploits unpatched legacy vulnerabilities, specifically CVE-2017-0199 and CVE-2017-11882, embedded in malicious DOCX and RTF documents. Both infection chains ultimately execute a remote HTML Application (HTA) file, which launches an obfuscated PowerShell loader to deploy Cobalt Strike beacons, granting persistent access to compromised networks.
The campaign primarily targets legal, finance, logistics, industrial production, construction, and technical departments within Russian B2B organizations. Attackers leverage Russian-controlled domains for command-and-control infrastructure and employ customized Cobalt Strike malleable profiles to evade detection. Seqrite Labs reports that over 20 initial infection files have been observed, with multiple infection chains and infrastructure components identified in the wild. The operation demonstrates a high level of technical sophistication and persistence, posing a significant threat to Russian corporate environments reliant on outdated security postures.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
As of the reporting period, the FrostBeacon campaign was still active against Russian organizations. The activity highlighted continued exploitation of unpatched legacy vulnerabilities and fileless execution techniques for persistence and evasion.
Analysis of the campaign revealed command-and-control infrastructure using more than 40 Russian-registered domains and hosting providers, with traffic designed to blend into legitimate web requests. Seqrite Labs published technical details and indicators of compromise, including hashes, domains, and email addresses, while noting TTP overlaps with Cobalt Group but no firm attribution.
Researchers identified two main infection clusters in FrostBeacon: phishing archives containing malicious LNK files disguised as documents, and weaponized DOCX/RTF files exploiting CVE-2017-0199 and CVE-2017-11882 to fetch HTA payloads. Both chains culminated in an obfuscated, multi-stage PowerShell loader that executed Cobalt Strike Beacon in memory.
A financially motivated campaign dubbed Operation FrostBeacon began targeting Russian B2B organizations, especially in logistics, industrial production, construction, and technical supply, with a focus on finance and legal departments. The attackers used phishing lures themed around contracts, payments, and legal disputes to gain initial access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 144 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and U.S. authorities reported multiple spearphishing campaigns linked with moderate confidence to **APT29/Nobelium/Cozy Bear** that targeted government agencies, NGOs, research institutions, embassies, and other high-value organizations. In one campaign, emails impersonating **USAID** used **Constant Contact** links to deliver malicious ISO files containing a decoy PDF, a weaponized **`.lnk`** shortcut, and a DLL loader that launched **Cobalt Strike Beacon** through `rundll32.exe`; CISA said the beacon used HTTP traffic disguised as requests for **`.woff2`** files and embedded metadata in a `_cfuid` cookie while contacting infrastructure including **theyardservice.com** subdomains and **worldhomeoutlet.com**. Volexity also identified a second-stage malware family, **FRESHFIRE**, which retrieved encrypted payloads from Firebase and decrypted them with host-specific logic before deleting the remote content. The activity fit a broader pattern seen in earlier and later operations attributed to the same cluster. FireEye documented a separate campaign in which attackers impersonated the **U.S. Department of State**, delivered ZIP archives with malicious shortcuts, used PowerShell to drop a decoy document, and installed Cobalt Strike Beacon communicating with **pandorasong.com** via a modified malleable C2 profile. Fortinet later described embassy-focused phishing that used **HTML smuggling** to build an ISO on the victim system, then relied on shortcut-triggered DLL execution to deploy another beacon, showing continued reuse of ISO-based delivery, decoy documents, and staged loaders across politically themed intrusion attempts.
Aug 15, 2026
Researchers traced command-and-control infrastructure used in a malicious email campaign targeting Ukraine to multiple **Cobalt Strike** servers and customized **Malleable C2** profiles designed to evade detection. The activity, described in **CERT-UA alert `#4490`**, involved malicious Microsoft Office macros attempting to deploy Cobalt Strike Beacon, while follow-on analysis identified at least eight distinct malleable profiles across the related infrastructure. Two 2022 profiles stood out: a common jQuery-themed profile and a rarer **"minimal defender bypass"** profile using the URI `/apiv8/getStatus`, with the latter sharing watermark `1580103824` across several domains and suggesting a clustered operator footprint. The reporting shows how Cobalt Strike’s profile customization can make beacon traffic resemble legitimate web activity and frustrate signature-based detection, especially when operators alter HTTP, HTTPS, or DNS transaction patterns instead of relying on default Beacon behavior. Investigators also found operational consistency in the campaign’s infrastructure, including concentration at a small set of hosting providers and registrars such as **HostKey** and **Eranet**, and identified an additional related domain, `furfen[.]com`, beyond those listed in the original alert. Together, the findings indicate a coordinated effort to tailor C2 traffic and reuse infrastructure in attacks against Ukrainian targets.
Aug 15, 2026
ESET reported a newly observed **FrostyNeighbor** campaign targeting governmental organizations in Ukraine with spearphishing emails carrying malicious PDF lures. The actor, also tracked as **Ghostwriter**, `UNC1151`, `UAC-0057`, `TA445`, `PUSHCHA`, and `Storm-0257`, used a document impersonating **Ukrtelecom** that linked victims to infrastructure performing server-side geographic filtering. Non-Ukrainian visitors received a benign decoy PDF, while Ukrainian IP addresses were served a malicious RAR archive, indicating deliberate target validation and a continued espionage focus on Ukraine and neighboring Eastern European states.
Jun 29, 2026