Cold lures, hot targets. [Research Saturday]

Summary

---

CyberWire Daily: "Cold Lures, Hot Targets" — Research Saturday

Date: July 25, 2026
Host: Dave Bittner (N2K Networks)
Guest: Andrej Kubovic, Security Awareness Specialist at ESET
Topic: ESET’s research into the espionage group “Frosty Neighbor” and their latest campaign: “Frosty Neighbor, Fresh Mischief and Digital Shenanigans”

---

Episode Overview

This Research Saturday examines ESET's latest findings on the advanced cyber-espionage group “Frosty Neighbor,” their alignment with Belarusian interests, their targets in Eastern Europe, and the sophisticated multi-stage attack chain leveraging spear phishing, a custom loader dubbed “Picasso Loader,” and Cobalt Strike. Andrej Kubovic offers an in-depth analysis of the group’s operational discipline, tool updates, and evasion tactics, and shares recommendations for defenders.

---

Key Discussion Points & Insights

1. Who is Frosty Neighbor?

• Belarus-Aligned Threat Actor:
  • Active since at least 2016.
  • Primarily targets Ukraine, Poland, Lithuania, and other European countries.
    Kubovic:

    "Their goals are aligned with Belarus. They are active since at least 2016 and their primary targets ... are focusing on geographically is typically around Belarus..." (01:30)

• Espionage Motivation:
  • Not financially motivated; focus on espionage.
  • Ukraine: Targets military, defense, and government.
  • Poland, Lithuania: Also hit manufacturing, healthcare, pharma, and logistics opportunistically.
    Kubovic:

    "It's definitely espionage motivation and they are looking at different sectors based on the country..." (02:25)

---

2. Attack Chain Walkthrough & Victim Profiling

• Spear Phishing Entry:
  • Specialized spear phishing email with a PDF attachment.
  • PDF displays a blurred document instructing the user to click for "full readable version."
• Geo-Fencing Check:
  • Malware only activates if the target’s IP is Ukrainian or from a selected region.
  • Others only see a harmless decoy.
    Kubovic:

    "There is a geographical check. If your IP is Ukrainian or any type of selected region ... it will not give you the content..." (03:08)

• Payload Delivery:
  • If target passes geo-check, a RAR archive is downloaded.
  • Archive contains JavaScript leading to “Picasso Loader,” a specialized staging tool.
• Tooling & Evasion:
  • Picasso Loader masquerades as an image downloader but can deliver a range of payloads, most notably Cobalt Strike.

---

3. Picasso Loader & Payloads

• History & Functionality:
  • Used in multiple campaigns; named for its image-related disguise.
  • Random, non-AI images used (games, drones, etc.).
• Malware Evolution & Updates:
  • Continuous update cycle for evasion; multiple programming language variants noted (.NET, PowerShell, JS, C).
    Kubovic:

    "If your tooling is documented and well documented, the problem is that it gets detected. So you need to work on your evasion techniques..." (05:56)

• Final Stage: Cobalt Strike
  • Widely abused red-team tool for remote access/control.
    Kubovic:

    "That final payload is Cobalt Strike, which is a known tooling for Red Teamers." (04:31)

---

4. Operational Discipline & Target Validation

• Rigorous Victim Validation:
  • Devices fingerprinted every 10 minutes (collecting usernames, computer names, local time, process IDs, etc.).
  • Reports sent to Command & Control; manual operator confirmation likely needed for full payload delivery.
    Kubovic:

    "Only victims that are probably manually decided by the operators actually get the final payload of Cobalt Strike." (06:53)

• Persistence Tactics:
  • Registry modifications for persistence.
  • Using Viber (desktop messaging app) as cover for malicious activity. (09:41)

---

5. Attacker Sophistication & Regional Context

• Advanced Evasion:
  • Frequent tool updates, modular architecture, and multilanguage support.
  • Efforts to mimic regular web traffic (web-associated file types abused for blending in).
• Regional Trends:
  • Similar TTPs seen among Russia-aligned actors.
  • Abuse of CVEs (including Roundcube webmail vulnerabilities) for credential harvesting and email espionage.
    Kubovic:

    "They seem to be also quite fluid ... trying to also blend in with the web traffic that we typically see." (11:53)

---

6. Defensive Recommendations

• Patch Management:
  • Immediate patching for known exploited CVEs.
• Network Monitoring:
  • Watch for suspicious communications/second & third-stage file drops.
  • Cobalt Strike beaconing can be detected through threat intelligence and network analysis. Kubovic:

    "All of this can be quite helpful for a skilled defender to block and detect." (14:04)

---

Notable Quotes & Memorable Moments

• On Target Validation:

  "The victim's computer is fingerprinted every 10 minutes... and only victims that are probably manually decided by the operators actually get the final payload of Cobalt Strike.” — Andrej Kubovic (06:53)

• On Tool Stealth:

  “We have seen this with any sophisticated actor: they are trying to figure out ways how to stay under the radar. Updates are one way how to do it.” — Andrej Kubovic (05:56)

• On Blending In:

  "They are trying to also blend in with the web traffic that we typically see... it’s quite complicated for you to detect." — Andrej Kubovic (12:38)

• On Defensive Action:

  “Patching your systems will always go a long way... based on threat intelligence, you can actually detect for that and block dropping of those second and third stages...” — Andrej Kubovic (14:04)

---

Important Timestamps

• [01:30] Frosty Neighbor’s alignment, targets, and motivation
• [03:08] Walkthrough of the attack chain, spear phishing, geo-check
• [04:31] Picasso Loader, payload delivery, history
• [05:56] Importance of updating attack tools for evasion
• [06:53] Victim validation and operational discipline
• [09:41] Technical details: persistence and abuse of Viber
• [10:39] Context: Similarity to regional/Russia-aligned campaigns
• [11:53] Assessment of group’s sophistication
• [13:15] Explanation of Cobalt Strike
• [14:04] Defensive tips for organizations

---

Summary

This episode delivers a detailed, expert-level breakdown of how “Frosty Neighbor” is deploying highly targeted, evolving spear-phishing campaigns for espionage aims in Eastern Europe. The threat group deploys advanced validation and persistence tactics, custom loaders, and commercial post-exploitation frameworks while evading detection through smart tooling updates and network blending. Defenders are reminded to maintain robust patching procedures, monitor for Cobalt Strike network traffic, and stay current on regional threat intelligence.

---

Transcript

[A]

You're listening to the Cyberwire Network powered by N2K.

[B]

If you're heading to Black Hat USA this year, make plans to visit the Spectre Ops Kennel Club. As creators of Bloodhound, the Spectre Ops team will host talks with OpenAI and the UK AI Security Institute, as well as hands on workshops aimed at helping you understand AI accelerated attack paths and the latest in identity tradecraft. Visit Spectrops IO to pre register and learn more. Spectrops Kennel Club is adjacent to Libertine Social inside Mandalay Bay. While you're there, visit the N2K CyberWire podcast studio where we'll be capturing expert perspectives and conversations from across Black Hat. Hello everyone and welcome to the Cyberwires Research Saturday. I'm Dave Bittner and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems and protecting ourselves in our rapidly evolving cyberspace. Thanks for joining us.

[A]

So what we can say their goals are aligned with Belarus. They are active since at least 2016 and their primary targets in the the area they are focusing on geographically is typically around Belarus, which is also playing into that alignment that I have been mentioning before. And they are targeting Poland, Lithuania and Ukraine the most. But we have seen also other countries in Europe.

[B]

That's Andrei Kubovic, Security Awareness Specialist from eset. The research we're discussing today is titled Frosty Neighbor, Fresh Mischief and Digital Shenanigans. And what does it seem like they're after here? Are they financially motivated or after? Is it an espionage motivation?

[A]

It's definitely espionage motivation and they are looking at different sectors based on the country that they are targeting. Because in Ukraine we see they are mostly after military, defense, governmental stuff. And in Poland and Lithuania and some of the other European countries it was also some maybe more opportunistic stuff such as manufacturing, healthcare, pharma, even logistics. So of course governmental is always in the mix if there is the opportunity. But also other sectors that were not seen in Ukraine.

[B]

Well, let's walk through the attack chain together here. How would someone find themselves targeted here and then what would happen next?

[A]

So the first main condition in this campaign that we documented was that you are from Ukraine because the whole chain doesn't work. They are doing this check. You receive a spear phishing email that has a PDF attached. You open it and instead of showing you the PDF it's some blurry version of it and you need to click on something so that you get the full visible readable version. Now before that Happens when you click. The thing is, there is a geographical check. If your IP is Ukrainian or any type of selected region because maybe they are interested in specific regions in Ukraine. It will not give you the content, it will show you the same decoy PDF as you would see when you are targeted. But the malicious stuff in the background is not happening. So that's the main thing that they are doing in the beginning. So that's the first check. But if it's correct, if your IP is from Ukraine, it downloads a RAR file, so an archive that will drop a JavaScript and that JavaScript is basically the first or maybe let's say second stage of attack. And that's Picasso Loader, which is actually something that we know to be a tooling of this group. So this is something that they have been developing and working on for years now.

[B]

Well, Picasso Loader has an interesting history here. What can you tell us about that?

[A]

We have seen it actually on several campaigns. It has been first documented by the Ukrainian cert and they have given it this name because Picasso Loader, as the name suggests, has some connection with pictures. It's actually because it's trying to it look like it's downloading a renderable image. Now that I was actually very curious about this and asking this with the researchers and what I've been told. It's not a specific topic of these pictures. So don't imagine something that is going to be very catchy for the eye. It's random. So we have seen games, we have seen drones, we have seen different topics of these pictures and it wasn't AI generated, which is also something maybe interesting today that we see. And yeah, I mean the fact is that they are using this Picasso Loader to get to the final stage, to the final payload. And that final payload is Cobalt Strike, which is a known tooling for Red Teamers.

[B]

Now Frosty Neighbor, they have this reputation for keeping their tooling up to date for updates along the way. What's the importance of that for a threat actor who's out there trying to do long term espionage?

[A]

The main thing is if your tooling is documented and well documented, the problem is that it gets detected. So you need to work on your evasion techniques. You need to figure out a way how to sidestep the detection. So of course that's what's behind the update cycle that you need to run. And of course you are also trying to avoid being spotted during, during the operation because cyber espionage is stealthy by design. So that's what they are trying to achieve by changing their tooling as much as possible. We have seen this, of course, with any sophisticated actor that they are trying to figure out ways how to stay under the radar. And as I say, the updates are one of the ways how to do it.

[B]

They seem to be pretty careful about validating their victims before they deliver that final payload is this. Tell us about this group's operational discipline.

[A]

So there are two, except for the check for the geography, there are also two other things that they are doing during the attack chain. First one is that the victim's computer is fingerprinted every 10 minutes. I mean it's getting a lot of information on the victim, including username, computer name, even the current time, so that they know where the victim actually is located. And of course stuff like process IDs so that they can see what's running on the machine. And that information is then reported to the command and control server. And only victims that are probably manually decided by the operators actually get the final payload of Cobalt Strike. So they are actually running, let's say, a level of automated checks and then the final decision sits probably with the operator.

[B]

We'll be right back. AI is making phishing attacks faster, more convincing and harder for people to spot. And traditional security awareness and phishing training weren't designed for this level of attack. HOX Hunt helps security teams prepare employees for the attacks they face every day with personalized phishing training that adapts to each employee and reduces risky behavior over time for IT and security leaders looking to strengthen their human layer of defense without adding more manual work. Visit hoxhunt.com cyberwire to learn more. That's H O X H-U-N-T.com cyberwire. Now, from the victim's perspective, what does an attack look like?

[A]

As I said, you receive a spear phishing email that has the PDF attached. The PDF shows you the decoy and drops second stage and third stage of the of the attack. And in the end, when you're infected by Cobalt Strike, what happens is that they can they get effectively access to your device and basically full control because that's what the red teaming tools are allowing you to. So that's what they are trying to achieve. And for you, most of that chain is of course invisible because again, espionage needs to be as stealthy as possible. So in the end when you're infected, the information is being pilfered out of your machine and sent to the CNC of the attackers. And for you, you saw the document, so that's basically where it Ends for you.

[B]

Were there any technical details in this campaign that you and your colleagues found particularly interesting or maybe even surprising?

[A]

I mean, there were interest. Even the fact that there has been an update cycle to this whole thing is interesting because we see that they are continuously active, developing their tooling, trying to evade detection, implementing these checks. That's also something that can be of interest. And they were also trying to achieve persistence. So they're modifying registries to run the malware at every startup and, and trying to use Viber as cover. So the desktop version of the communication app as cover. So I would say some of those things might be interesting. It depends on the beauty is in the eye of the beholder. So there are several things that could catch your attention.

[B]

Yeah. What does this campaign say about the current state of things in Eastern Europe? Is this the type of thing, a typical type of thing that researchers see in that part of the world?

[A]

I would say to a level, yes. Because we have seen similar techniques that they have been using in the past campaigns, but even in this one also being used by Russia aligned actors. I'm not saying the same one. For example, we have seen a very similar tactic being used, but exploiting a specific CVE and it was trying to abuse roundcube, which is a quite popular webmail application. And what they were trying to achieve was to attack the victim during the email opening phase. So when you open the email, they are trying to harvest your credentials and use that to spy on you and get information from your emails. We have seen similar campaign or similar approach by other actors in the region, but they were using a different cve, which again probably shows that these guys are technically very capable and showing that they know how to run similar campaigns.

[B]

Yeah, I mean, it strikes me that this seems to be a fairly sophisticated group. Is that a fair assessment?

[A]

Yes, yes, that's a fair assessment because we have seen different approaches deployed in their attacks. For example, we can say that the main downloader, the Picasso loader, has multiple variants. So they are quite capable with different languages. DotNet, PowerShell, JavaScript, this case was JavaScript, the recent one C. So they are capable of rewriting and updating the tooling in different languages. They are also capable of abusing known vulnerabilities and finding ways how to abuse them for their own campaigns. And again, they seem to be also quite fluid. Fluid. And what's being used, what makes them invisible in the targeted environment. So for example, they are trying to also blend in with the web traffic that we typically see. So some web associate file types they are abusing because your computer is typically processing a lot of those during the day, so this blends in with the traffic and it's quite complicated for you to detect. So yes, they seem to be quite technically skilled.

[B]

Swinging back around, you mentioned that the final payload is Cobalt Strike. For folks who may not be familiar with that, how do you describe that?

[A]

It's a legitimate security tool which is typically used by pen testers and professionals in cybersecurity to test how good your defenses are if there is anything vulnerable in your environment. And using that tool gives you all the touch. You can try to touch different parts of your system and figure out what's wrong. Of course, if this falls in the wrong hands or if that type of tool can be dropped on a system, it gives you quite a powerful framework or tool in your hands which you can use for remote access and some serious intrusion.

[B]

What are your recommendations for the defenders in our audience to protect themselves against this sort of thing?

[A]

So I'll start at the basics. As I mentioned, there were some CVEs and stuff that's being abused. So of course patching your systems is something that will always go a long way. In this case, you would have to be capable of actually seeing that communication with the server, but based on threat intelligence, you can actually detect for that and block dropping of those second and third stages of these of this attack. And of course, Cobalt Strike, when it's active, it has some communication that's going to the servers of the attacker. So again, something that can be detected, the network communication. So all of this can be quite helpful for a skilled defender to block and detect.

[B]

Our thanks to Andrej Kabovic from ESET for joining us. The research is titled Frosty Fresh Mischief and Digital Shenanigans. We'll have a link in the show Notes and that's Research Saturday. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com this episode is produced by Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here next time. Heading to Black Hat USA, the N2K CyberWire team will be on site recording from our podcast studio in the Spectrops Kennel Club. If you're interested in joining us for a conversation or learning more about what we're recording throughout the week, stop by the studio and meet the N2K CyberWire team. Spectorops Kennel Club is adjacent to Libertine Social inside Mandalay Bay.