FrostyNeighbor Uses PDF Lures and PicassoLoader Against Ukrainian Government Targets
Summary
ESET reports that FrostyNeighbor targeted Ukrainian government organizations from March 2026 with spearphishing PDF lures, a JavaScript PicassoLoader chain, server-side victim checks, and a Cobalt Strike payload.
Key points
- ESET observed and attributed new FrostyNeighbor activity targeting Ukrainian government organizations beginning in March 2026.
- Spearphishing PDFs impersonated Ukrtelecom and linked to a delivery server; targets outside the expected location received a benign decoy PDF.
- For selected targets, a RAR archive delivered a JavaScript dropper that displayed a decoy and launched a JavaScript version of PicassoLoader.
- PicassoLoader collected host and process information and sent it to its command server; operators could use the information to decide whether to deliver the next stage.
- The final stage installed a Cobalt Strike beacon and established persistence using a registry Run key and a scheduled task.
- ESET describes FrostyNeighbor as a long-running actor focused on Eastern Europe and notes prior use of credential-harvesting pages and exploitation of WinRAR and Roundcube vulnerabilities.
Article Details
- Attack Vectors
- Since March 2026, FrostyNeighbor has targeted Ukrainian governmental organizations with spearphishing PDFs containing links to attacker-controlled delivery infrastructure.
- For selected victims, a RAR archive delivers a JavaScript dropper that displays a decoy PDF and runs an embedded JavaScript PicassoLoader downloader.
- PicassoLoader fingerprints the computer and sends the information to its C2 server; operators may then return a JavaScript dropper that installs a Cobalt Strike beacon.
- Related campaigns have used credential-harvesting phishing pages and reportedly exploited CVE-2023-38831 in WinRAR and CVE-2024-42009 in Roundcube.
- Defensive Notes
- Monitor for the reported delivery domains and C2 endpoints, including the scheduled-task template request and PicassoLoader HTTP POST activity.
- The reported chain creates a scheduled task and registry-based persistence, and places files under %AppData%WinDataScope and %ProgramData%ViberPC.
- The report recommends close monitoring of FrostyNeighbor’s operations, infrastructure, and toolset changes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | attachment-storage-asset-static[.]needbinding[.]icu | Listed as a PicassoLoader C2 server. |
| DOMAIN | best-seller[.]lavanille[.]buzz | Listed as a Cobalt Strike C2 server. |
| DOMAIN | book-happy[.]needbinding[.]icu | PicassoLoader C2 server used for payload delivery and victim fingerprint reporting. |
| DOMAIN | easiestnewsfromourpointofview[.]algsat[.]icu | Listed as a PicassoLoader C2 server. |
| DOMAIN | hinesafar[.]sardk[.]icu | Listed as a PicassoLoader C2 server. |
| DOMAIN | mickeymousegamesdealer[.]alexavegas[.]icu | Listed as a PicassoLoader C2 server. |
| DOMAIN | nama-belakang[.]nebao[.]icu | Cobalt Strike C2 server contacted by the reported beacon. |
| DOMAIN | shinesafar[.]sardk[.]icu | Listed as a PicassoLoader C2 server. |
| SHA1 | 27fa11f6a1d653779974b6fb54de4af47f211232 | SHA-1 of a reported Cobalt Strike beacon. |
| SHA1 | 3fa7d1b13542f1a9eb054111f9b69c250af68643 | SHA-1 of a reported FrostyNeighbor lure RAR archive. |
| SHA1 | 43e30be82d82b24a6496f6943ecb6877e83f88ab | SHA-1 of the reported Cobalt Strike beacon. |
| SHA1 | 4e52c92709a918383e90534052aaa257ace2780c | SHA-1 of a reported JavaScript dropper. |
| SHA1 | 4f2c1856325372b9b7769d00141dbc1a23bddd14 | SHA-1 of the reported lure PDF. |
| SHA1 | 6fded427a16d5314ba3e1eb9afd120dc84449769 | SHA-1 of a reported JavaScript PicassoLoader downloader. |
| SHA1 | 776a43e46c36a539c916ed426745ee96e2392b39 | SHA-1 of the reported FrostyNeighbor lure RAR archive. |
| SHA1 | 7e537d8e91668580a482bd77a5a4caba26d6bdac | SHA-1 of a reported JavaScript PicassoLoader downloader. |
| SHA1 | 8d1f2a6df51c7783f2eaf1a0fc0ff8d032e5b57f | SHA-1 of the reported JavaScript dropper. |
| SHA1 | b65551d339aece718ea1465bf3542c794c445efc | SHA-1 of the reported JavaScript PicassoLoader downloader. |
| SHA1 | d89e5524e49199b1c3b66c524e7a63c3f0a0c199 | SHA-1 of a reported FrostyNeighbor lure PDF. |
| SHA1 | e15abee1cfde8be7d87c7c0b510450bad6bc0906 | SHA-1 of the reported Cobalt Strike dropper. |
| SHA1 | fa6882672ad3654800987613310d7c3fbade027e | SHA-1 of a reported JavaScript PicassoLoader downloader. |
| URL | hxxps[:]//book-happy[.]needbinding[.]icu/employment/documents-and-resources | PicassoLoader C2 endpoint receiving victim fingerprint data and returning later-stage content. |
| URL | hxxps[:]//book-happy[.]needbinding[.]icu/wp-content/uploads/2023/10/1GreenAM.jpg | Attacker-controlled C2 URL used to deliver the scheduled-task template. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article reports obfuscation of scripts and compiled binaries.T1027.009 · Embedded PayloadsThe PicassoLoader downloader is embedded in the JavaScript dropper as base64-encoded content.T1036.005 · Match Legitimate Resource Name or LocationThe dropper copies rundll32.exe to the masquerading filename %ProgramData%ViberPC.exe.T1041 · Exfiltration Over C2 ChannelThe article describes victim fingerprint data being sent to C2 and identifies Cobalt Strike HTTPS communication as exfiltration over the C2 channel.T1053.005 · Scheduled TaskThe JavaScript stage downloads a task template and creates a scheduled task to trigger PicassoLoader.T1057 · Process DiscoveryPicassoLoader collects a list of running processes and their process IDs.T1059 · Command and Scripting InterpreterJavaScript stages perform dropper, downloader, and payload-delivery actions.T1060 · Registry Run Keys / Startup FolderThe reported chain imports registry data and registers a link in the HKCU Run key for persistence.T1071.001 · Web ProtocolsThe article reports HTTPS use for C2 communications and payload delivery.T1082 · System Information DiscoveryPicassoLoader collects the username, computer name, OS version, and system timing information.T1204.002 · Malicious FileVictims are induced to open the delivered document or archive to start the compromise chain.T1566.001 · Spearphishing AttachmentThe reported campaign delivered malicious PDF lures through spearphishing attachments.T1583 · Acquire InfrastructureThe article states that FrostyNeighbor acquires domains and rents C2 servers.T1588.002 · ToolThe article reports that the actors obtained a leaked Cobalt Strike version to generate payloads.T1608 · Stage CapabilitiesThe group hosts final payloads on C2 servers before delivery to selected victims.
CVE
Threat Actors
FrostyNeighborESET attributes the reported spearphishing and malware activity targeting governmental organizations in Ukraine to FrostyNeighbor.PUSHCHAThe article identifies PUSHCHA as another name for FrostyNeighbor, which ESET attributes with the reported cyberespionage activity.Storm-0257The article identifies Storm-0257 as another name for FrostyNeighbor, which ESET attributes with the reported cyberespionage activity.TA445The article identifies TA445 as another name for FrostyNeighbor, which ESET attributes with the reported cyberespionage activity.UNC1151The article identifies Ghostwriter as another name for FrostyNeighbor, which ESET attributes with the reported cyberespionage activity.
Malware
Tools
Countries
BelarusFrostyNeighbor is a long-running cyberespionage actor apparently aligned with the interests of Belarus.LithuaniaThe group primarily targets governmental, military, and other key sectors in Eastern Europe, with strong focus on Ukraine, Poland, and Lithuania.PolandThe group primarily targets governmental, military, and other key sectors in Eastern Europe, with strong focus on Ukraine, Poland, and Lithuania.UkraineThe report describes newly observed FrostyNeighbor activity against governmental organizations in Ukraine, including a March 2026 compromise chain that uses spearphishing PDFs, JavaScript-based PicassoLoader, and a
Industries
DefenseWhile Ukrainian targeting seems to be focused on military, defense sector, and governmental entities, the victimology in Poland and Lithuania is broader and includes, among others, a wide variety of sectors likeGovernmentIn February 2025, SentinelOne documented a surge of activity targeting Ukrainian government and opposition activists in Belarus, using new adaptations of previously observed payloads.Healthcare and Pharmaceuticalsand includes, among others, a wide variety of sectors like industrial and manufacturing, healthcare and pharmaceuticals, logistics, and many governmental organizations.industrial and manufacturingin Poland and Lithuania is broader and includes, among others, a wide variety of sectors like industrial and manufacturing, healthcare and pharmaceuticals, logistics, and many governmental organizations.logisticsothers, a wide variety of sectors like industrial and manufacturing, healthcare and pharmaceuticals, logistics, and many governmental organizations.MilitaryThe group primarily targets governmental, military, and other key sectors in Eastern Europe, with strong focus on Ukraine, Poland, and Lithuania.