Operation FrostBeacon: Multi-Cluster Cobalt Strike Campaign Targets Russia
Essential information
- Published
- 08/12/2025 17:25
- Modified
- 21/12/2025 18:43
- Tags
- 2025-12-08 CVE-2017-0199 CVE-2017-11882 cobalt strike hta lnk files phishing powershell russia
- Related entities
- 2 vulnerabilities (cve), 60 observables, 12 techniques (mitre), 1 malware, 25 others
Description
Operation FrostBeacon is a targeted malware campaign delivering Cobalt Strike beacons to companies in Russia. It uses two infection clusters: one leveraging malicious archive files with LNK shortcuts, and another exploiting CVE-2017-0199 and CVE-2017-11882 vulnerabilities. Both clusters lead to remote HTA execution and deployment of an obfuscated PowerShell loader that decrypts and runs Cobalt Strike shellcode in memory. The campaign targets finance and legal departments of B2B enterprises in logistics, industrial production, construction, and technical supply. It employs phishing emails with Russian-language lures related to contracts, payments, and legal matters. The infrastructure uses multiple Russian-controlled domains as command-and-control servers.