FrostyNeighbor: Fresh mischief and digital shenanigans

MITRE Techniques

• [T1583 ] Acquire Infrastructure – The group acquires domains and rents C&C servers for its operations (‘acquires domain names and rents C&C servers’).
• [T1608 ] Stage Capabilities – Final payloads are hosted on attacker-controlled servers before delivery (‘hosts the final payload on a C&C server’).
• [T1588.002 ] Obtain Capabilities: Tool – The actors obtained a leaked Cobalt Strike version to generate payloads (‘obtained a leaked version of Cobalt Strike to generate payloads’).
• [T1566.001 ] Phishing: Spearphishing Attachment – Weaponized lure documents are delivered as email attachments (‘sends a weaponized lure document in email attachments’).
• [T1204.002 ] User Execution: Malicious File – Victims are tricked into opening documents or archives to trigger code execution (‘tricks its victims into opening or editing a document to gain code execution’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Scheduled tasks are used to trigger persistence and execution (‘uses scheduled tasks to achieve persistence’).
• [T1059 ] Command and Scripting Interpreter – JavaScript, Visual Basic, and PowerShell are used to run malicious logic (‘uses scripting languages such as JavaScript, Visual Basic, and PowerShell’).
• [T1060 ] Registry Run Keys / Startup Folder – Registry Run keys are used for persistence (‘uses the registry Run key and the Startup Folder to achieve persistence’).
• [T1027 ] Obfuscated Files or Information – Scripts and binaries are obfuscated to hinder analysis (‘obfuscates scripts and compiled binaries’).
• [T1027.009 ] Obfuscated Files or Information: Embedded Payloads – Later-stage payloads are embedded inside initial lure content (’embeds next stages or payloads inside the initial lure document’).
• [T1036.005 ] Masquerading: Match Legitimate Resource Name or Location – Malicious files are dropped with common Microsoft-style names and paths (‘drops malicious files using common Microsoft filenames and locations’).
• [T1057 ] Process Discovery – PicassoLoader collects running process information (‘collects the list of running processes’).
• [T1082 ] System Information Discovery – PicassoLoader gathers user and system details (‘collects system and user information’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – HTTPS is used for command-and-control and delivery (‘uses HTTPS for C&C communication and payload delivery’).
• [T1041 ] Exfiltration Over C2 Channel – Data is sent over the C2 channel with Cobalt Strike (‘uses HTTPS with Cobalt Strike’).