FrostyNeighbor: Fresh mischief and digital shenanigans
This blogpost covers newly discovered activities attributed to FrostyNeighbor, targeting governmental organizations in Ukraine. FrostyNeighbor has been running continual cyberoperations, changing and updating its toolset regularly, updating its compromise chain and methods to evade detection – targeting victims located in Eastern Europe, according to our telemetry.
Key points of the report:FrostyNeighbor is a long-running cyberespionage actor apparently aligned with the interests of Belarus.The group primarily targets governmental, military, and key sectors in Eastern Europe.This report documents new activity observed that started in March 2026, showing continued evolution of tooling and compromise chains.FrostyNeighbor uses server-side validation of its victims before delivering the final payload.The group has been active recently in campaigns targeting governmental organizations in Ukraine.
Introduction
FrostyNeighbor, also known as Ghostwriter, UNC1151, UAC‑0057, TA445, PUSHCHA, or Storm-0257, is a group allegedly operating from Belarus. According to Mandiant, the group has been active since...
Copyright of this story solely belongs to welivesecurity.com. To see the full text click HERE
