FrostyNeighbor: Fresh Mischief and Digital Threats

Summary

ESET reports that the FrostyNeighbor APT group, also tracked as Ghostwriter, has resumed attacks against Ukrainian government organizations using spear-phishing PDFs that deliver a JavaScript-based downloader known as PicassoLoader, which ultimately deploys a Cobalt Strike beacon. The campaign relies on geo-based validation, scheduled-task persistence, and multiple file-dropping techniques to reduce visibility and evade detection. Its infrastructure is positioned behind Cloudflare and uses several needbinding.icu domains.

Investigation

Researchers reconstructed the full attack chain, starting with the malicious PDF lure, continuing through the JavaScript dropper and PicassoLoader downloader, and ending with the delivery of the Cobalt Strike payload. They extracted indicators including filenames, registry changes, and command-and-control URLs, then linked them to known FrostyNeighbor tradecraft. The report also highlights exploitation of CVE-2023-38831 in WinRAR and CVE-2024-42009 in Roundcube.

Mitigation

Organizations should block suspicious attachment types, enforce strict controls over macro and script execution, monitor for scheduled tasks created by unfamiliar binaries, and restrict outbound HTTPS traffic to known malicious domains. The referenced vulnerabilities should be patched promptly, and least-privilege restrictions should be applied to rundll32.exe usage.

Response

If any related indicators are detected, isolate the affected system immediately, collect forensic artifacts, and hunt for both the Cobalt Strike beacon and PicassoLoader components. Reset any exposed credentials and review scheduled tasks and Run key entries for signs of persistence.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  The adversary has obtained a foothold on the victim host and wishes to deploy a Cobalt Strike beacon while staying under the radar. They:

  1. Copy rundll32.exe to a non‑standard location (C:ProgramDataTemprundll32.exe) to evade simple whitelist alerts.
  2. Drop the malicious DLL (ViberPC.dll) into %ProgramData%. This DLL contains the bootstrapped Cobalt Strike payload.
  3. Execute the copied rundll32.exe with a command line that loads the malicious DLL (%ProgramData%ViberPC.dll).
  4. Drop two JavaScript files (53_7.03.2026_R.js and Update.js) that contain JScript that contacts the C2 server and finalizes the beacon installation.
  5. Run the JavaScript files using cscript.exe, causing the creation of processes whose Image ends with .js and whose CommandLine contains the exact filenames.

  These steps generate the exact Sysmon process‑creation events matched by selection1, selection2, and selection3 in the Sigma rule.

• Regression Test Script:

  # FrostyNeighbor Cobalt Strike Deployment Simulation
  # -------------------------------------------------
  # 1. Prepare paths
  $tempDir = "$env:ProgramDataTemp"
  $rundllCopy = Join-Path $tempDir "rundll32.exe"
  $malDll    = "$env:ProgramDataViberPC.dll"
  $js1       = "$env:ProgramData53_7.03.2026_R.js"
  $js2       = "$env:ProgramDataUpdate.js"
  
  # 2. Ensure temp directory exists
  New-Item -Path $tempDir -ItemType Directory -Force | Out-Null
  
  # 3. Copy rundll32.exe to a non‑standard location
  Copy-Item -Path "$env:SystemRootSystem32rundll32.exe" -Destination $rundllCopy -Force
  
  # 4. Create a dummy malicious DLL (in real attack this would be the payload)
  $dummyDll = [IO.File]::ReadAllBytes("$env:SystemRootSystem32driversetchosts") # placeholder binary
  [IO.File]::WriteAllBytes($malDll, $dummyDll)
  
  # 5. Execute the copied rundll32 with the malicious DLL
  Start-Process -FilePath $rundllCopy -ArgumentList "`"$malDll`"" -WindowStyle Hidden
  
  # 6. Drop JavaScript payloads
  $jsContent = @"
  // Simple JScript that reaches out to a C2 endpoint (simulated)
  var xhr = new ActiveXObject("MSXML2.XMLHTTP");
  xhr.open("GET", "http://127.0.0.1:8080/beacon", false);
  xhr.send();
  "@
  
  Set-Content -Path $js1 -Value $jsContent -Encoding ASCII
  Set-Content -Path $js2 -Value $jsContent -Encoding ASCII
  
  # 7. Execute the JavaScript files via cscript (this creates processes with .js image)
  Start-Process -FilePath "cscript.exe" -ArgumentList "//NoLogo `"$js1`"" -WindowStyle Hidden
  Start-Process -FilePath "cscript.exe" -ArgumentList "//NoLogo `"$js2`"" -WindowStyle Hidden
  
  # 8. Pause to allow SIEM ingestion
  Start-Sleep -Seconds 15

• Cleanup Commands:

  # Cleanup after simulation
  $paths = @(
      "$env:ProgramDataViberPC.dll",
      "$env:ProgramData53_7.03.2026_R.js",
      "$env:ProgramDataUpdate.js",
      "$env:ProgramDataTemprundll32.exe"
  )
  foreach ($p in $paths) {
      if (Test-Path $p) { Remove-Item -Path $p -Force }
  }
  # Optionally stop any lingering cscript processes started by the test
  Get-Process -Name cscript -ErrorAction SilentlyContinue | Stop-Process -Force