Ghostwriter group resumes attacks on Ukrainian Government targets

ESET discovered a FrostyNeighbor/Ghostwriter campaign since March 2026 targeting Ukrainian government organizations via spear-phishing PDFs that geofence victims (only delivering malicious RAR/JS to Ukrainian IPs). The JS PicassoLoader profiles hosts and checks in periodically; operators manually decide whether to deploy a Cobalt Strike beacon. The operation uses process masquerading, registry persistence, Cloudflare-backed C2, and decoy documents to evade automated analysis, with IOCs published by ESET and recommendations for targeted sectors to review detections.