{
  "name": "Likely Belarus-Nexus Threat Actor Delivers Downloader to Poland",
  "slug": "likely-belarus-nexus-threat-actor-delivers-downloader-to-poland",
  "description": "A malicious CHM file targeting Poland was discovered, containing an infection chain that drops and executes a C++ downloader. The CHM file displays a decoy image while executing obfuscated JavaScript to extract and run a DLL. The downloader retrieves a payload from a domain associated with previous Belarus-linked threat activities. The payload is encrypted and appended to an image file. The infection process involves multiple stages, including the use of LOLbins and the creation of a scheduled task for persistence. This campaign shows similarities to activities attributed to threat actors like FrostyNeighbor and UNC1151, known for targeting Eastern European countries.",
  "published": "2025-07-14T09:55:54+00:00",
  "created_at": "2025-07-14T09:55:54+00:00",
  "modified_at": "2025-07-14T12:13:23+00:00",
  "created_at_opencti": "2025-07-14T09:55:54+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-07-14",
    "downloader",
    "scheduled task",
    "steganography"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "https://rustyquill.top/shw/the-magnus-protoco1.jpg"
      },
      {
        "id": "",
        "name": "f55e06a87e2a20989ddb76d9f2e3ebb303659ad306ba54e3ed7f8dcc4456d71b"
      },
      {
        "id": "",
        "name": "d3f0f747e56431c6d7c0259bc2afa2769898810140e8382af55d8297142a8529"
      },
      {
        "id": "",
        "name": "be5a40b5622d21b46cbc87fd6c3f8ebcb536ec8480491a651c1625ee03ae2c6f"
      },
      {
        "id": "",
        "name": "4d09fad2630ec33ab6bb45b85455c6a6ac7b52f8dae9b90736db4a5f00f72ea9"
      },
      {
        "id": "",
        "name": "156ad4975e834355b2140d3c8fe62798fe6883364b8af1a1713f8b76c7b33947"
      },
      {
        "id": "",
        "name": "1286aa5c73cf2c8058c52271869a5727d71ca5bd4dd0854be970d2a25cb52bf8"
      },
      {
        "id": "",
        "name": "0d3dbaa764acb2b87ae075aa2f5f924378991b39587b0c5e67a93b10db39ddd9"
      },
      {
        "id": "",
        "name": "0631696f484633f4aeb8f817af2a668806ab4dca70f006dc56fc9cd9dcda4dbe"
      }
    ],
    "malware": [
      {
        "id": "dd34b02f-3531-4405-8c07-ef55486cd939",
        "name": "net32.dll",
        "slug": "net32dll"
      },
      {
        "id": "2a926223-71e8-4cdd-86f7-2fcca9db3215",
        "name": "uNT32.dll",
        "slug": "unt32dll"
      }
    ],
    "intrusion_sets": [
      {
        "id": "f66d4ff5-ef2a-4c5d-b183-8ed3b993814e",
        "name": "FrostyNeighbor",
        "slug": "frostyneighbor"
      }
    ],
    "attack_patterns": [
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "81b422de-709e-43bd-b471-2befac0c623a",
        "name": "T1218.011"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Latvia"
      },
      {
        "id": "",
        "name": "Lithuania"
      },
      {
        "id": "",
        "name": "Poland"
      },
      {
        "id": "",
        "name": "Germany"
      },
      {
        "id": "",
        "name": "Ukraine"
      },
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://dmpdump.github.io/posts/Belarus-nexus_Threat_Actor_Target_Poland",
    "https://otx.alienvault.com/pulse/6874f04a68b34778c485cb14"
  ]
}