FrostyNeighbor Cyberespionage Campaign Targets Ukrainian and Polish Governments

FrostyNeighbor, a Belarus-aligned APT, has been conducting a high-severity cyberespionage campaign since March 2026 against Ukrainian and Polish government organizations. The group leverages spearphishing with malicious PDFs impersonating Ukrtelecom to deliver a JavaScript variant of PicassoLoader that stages Cobalt Strike, fingerprints victim systems for geo-selective payload delivery, and exploits vulnerabilities including CVE-2024 and CVE-2023-38831 to target military and governmental entities.