Loading story…
ESET reported a newly observed FrostyNeighbor campaign targeting governmental organizations in Ukraine with spearphishing emails carrying malicious PDF lures. The actor, also tracked as Ghostwriter, UNC1151, UAC-0057, TA445, PUSHCHA, and Storm-0257, used a document impersonating Ukrtelecom that linked victims to infrastructure performing server-side geographic filtering. Non-Ukrainian visitors received a benign decoy PDF, while Ukrainian IP addresses were served a malicious RAR archive, indicating deliberate target validation and a continued espionage focus on Ukraine and neighboring Eastern European states.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-21, CERT-UA reported a phishing campaign active since spring 2026 targeting Ukrainian government organizations via compromised email accounts and Prometheus certificate-themed lures. The advisory described a malware chain using OYSTERFRESH, OYSTERBLUES, and OYSTERSHUCK, assessed the activity as typical of UAC-0057/UNC1151, and noted possible later-stage Cobalt Strike delivery.
On 2026-05-14, ESET publicly reported the newly discovered FrostyNeighbor activity and linked it to the long-running cyberespionage actor also tracked as Ghostwriter, UNC1151, UAC-0057, TA445, PUSHCHA, and Storm-0257. The report highlighted the group's evolving tooling and continued focus on Ukraine and neighboring Eastern European countries.
On 2026-05-07, ESET Research published indicators of compromise for the FrostyNeighbor campaign, including lure files, JavaScript stages, PicassoLoader components, Cobalt Strike infrastructure, and ATT&CK mappings. The IoCs documented command-and-control domains and other artifacts first observed during the March-April 2026 activity targeting Ukrainian government organizations.
In the observed March 2026 activity, Ukrainian victims were served a malicious RAR archive containing JavaScript stages, including a PicassoLoader variant that fingerprinted hosts and beaconed to attacker infrastructure every 10 minutes. After likely manual operator validation, the attackers deployed a Cobalt Strike dropper that masqueraded as Viber software and established persistence via registry Run keys and LNK execution.
Beginning in March 2026, ESET observed FrostyNeighbor targeting governmental organizations in Ukraine with spearphishing emails carrying malicious PDF attachments. The campaign used a lure impersonating Ukrtelecom and infrastructure that served different content based on the victim's geographic location.
Between 2024-07-12 and 2024-07-18, CERT-UA observed increased UAC-0057 activity using macro-enabled lure documents on local self-government reform, USAID/DAI HOVERLA, taxation, and financial-economic themes to infect Ukrainian local self-government bodies. The documents executed PICASSOLOADER to deliver Cobalt Strike Beacon, and CERT-UA published file, network, and host-based indicators for the campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 200 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
10 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcetherecord.media
Open sourcesecurityaffairs.com
Open sourcewelivesecurity.com
Open sourcegithub.com
Open sourcecert.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.
Aug 15, 2026
A financially motivated cybercrime group has launched Operation FrostBeacon, a sophisticated malware campaign targeting business-to-business (B2B) enterprises across the Russian Federation. The attackers use a dual infection strategy: one method involves phishing emails containing archive files with malicious LNK shortcuts disguised as PDF documents, which, when executed, trigger hidden PowerShell commands to download further payloads. The second method exploits unpatched legacy vulnerabilities, specifically CVE-2017-0199 and CVE-2017-11882, embedded in malicious DOCX and RTF documents. Both infection chains ultimately execute a remote HTML Application (HTA) file, which launches an obfuscated PowerShell loader to deploy Cobalt Strike beacons, granting persistent access to compromised networks. The campaign primarily targets legal, finance, logistics, industrial production, construction, and technical departments within Russian B2B organizations. Attackers leverage Russian-controlled domains for command-and-control infrastructure and employ customized Cobalt Strike malleable profiles to evade detection. Seqrite Labs reports that over 20 initial infection files have been observed, with multiple infection chains and infrastructure components identified in the wild. The operation demonstrates a high level of technical sophistication and persistence, posing a significant threat to Russian corporate environments reliant on outdated security postures.
Jun 29, 2026
UNC1151, also known as **Ghostwriter** and **FrostyNeighbor**, targeted Belarusian pro-democracy politician **Yury Hubarevich** with a phishing email masquerading as a Russian-language Google security alert. The lure redirected the victim through a compromised Ukrainian website to a counterfeit Gmail sign-in page that captured credentials in real time using a background WebSocket connection, a technique that can help attackers intercept session data and bypass SMS- or one-time-password-based MFA protections. Investigators linked the phishing page to a broader credential-theft infrastructure tied to UNC1151 by pivoting on certificates, server fingerprints, and hosting patterns. The network used domains such as `account[.]check-profile[.]digital`, hid backend systems behind **Bunny CDN** and **Cloudflare**, and exposed additional infrastructure on a Datagear-hosted IP in Poland. Researchers also found phishing pages impersonating Ukrainian services including **I.UA**, **bigmir)net**, and **META.UA**, indicating the operation extended beyond a single spear-phishing attempt and formed part of a wider campaign targeting users in Belarus and Ukraine.
Jul 12, 2026