{
  "name": "Operation FrostBeacon: Multi-Cluster Cobalt Strike Campaign Targets Russia",
  "slug": "operation-frostbeacon-multi-cluster-cobalt-strike-campaign-targets-russia",
  "description": "Operation FrostBeacon is a targeted malware campaign delivering Cobalt Strike beacons to companies in Russia. It uses two infection clusters: one leveraging malicious archive files with LNK shortcuts, and another exploiting CVE-2017-0199 and CVE-2017-11882 vulnerabilities. Both clusters lead to remote HTA execution and deployment of an obfuscated PowerShell loader that decrypts and runs Cobalt Strike shellcode in memory. The campaign targets finance and legal departments of B2B enterprises in logistics, industrial production, construction, and technical supply. It employs phishing emails with Russian-language lures related to contracts, payments, and legal matters. The infrastructure uses multiple Russian-controlled domains as command-and-control servers.",
  "published": "2025-12-08T16:25:05+00:00",
  "created_at": "2025-12-08T16:25:05+00:00",
  "modified_at": "2025-12-21T17:43:18+00:00",
  "created_at_opencti": "2025-12-08T16:25:05+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-12-08",
    "CVE-2017-0199",
    "CVE-2017-11882",
    "cobalt strike",
    "hta",
    "lnk files",
    "phishing",
    "powershell",
    "russia"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "http://bti25.ru/china.hta"
      },
      {
        "id": "",
        "name": "http://order.edrennikov.ru/jquery-3.3.1.min.js"
      },
      {
        "id": "",
        "name": "https://iplogger.cn/forensicsas.png"
      },
      {
        "id": "",
        "name": "http://zetag.ru/siro.doc"
      },
      {
        "id": "",
        "name": "https://incident.zilab.ru:8443/jquery-3.3.1.slim.min.js"
      },
      {
        "id": "",
        "name": "http://canature.su/ya.hta"
      },
      {
        "id": "",
        "name": "https://ezstat.ru/flowersforlove.gif"
      },
      {
        "id": "",
        "name": "http://zetag.ru/z.hta"
      },
      {
        "id": "",
        "name": "https://bsprofi.ru/min.hta"
      },
      {
        "id": "",
        "name": "https://ipgrabber.ru/penis.gif"
      },
      {
        "id": "",
        "name": "https://iplis.ru/tramp.jpg"
      },
      {
        "id": "",
        "name": "http://ecols.ru/ecols.hta"
      },
      {
        "id": "",
        "name": "http://gemme-cotti.ru/cotti.docx"
      },
      {
        "id": "",
        "name": "https://iplis.ru/laydowngrenade.jpeg"
      },
      {
        "id": "",
        "name": "https://moscable77.ru:8443/jquery-3.3.1.slim.min.js"
      },
      {
        "id": "",
        "name": "http://valisi.ru/first.rtf"
      },
      {
        "id": "",
        "name": "http://vlasta-s.ru/logista.rtf"
      },
      {
        "id": "",
        "name": "http://dosingpumps.ru/nciki.hta"
      },
      {
        "id": "",
        "name": "http://gemme-cotti.ru/mida.hta"
      },
      {
        "id": "",
        "name": "https://yip.su/certgovrufuck.gif"
      },
      {
        "id": "",
        "name": "https://ezstat.ru/txttx.txt"
      },
      {
        "id": "",
        "name": "http://ecols.ru/gogo.rtf"
      },
      {
        "id": "",
        "name": "https://ekostroy33.ru/jquery-3.3.2.min.js"
      },
      {
        "id": "",
        "name": "http://poopy.aarkhipov.ru:8080/jquery-3.3.1.slim.min.js"
      },
      {
        "id": "",
        "name": "https://iplis.ru/lovers.jpeg"
      },
      {
        "id": "",
        "name": "http://emec.su/bg.rtf"
      },
      {
        "id": "",
        "name": "http://clack.su/fox.docx"
      },
      {
        "id": "",
        "name": "http://gemme-cotti.ru/zibaba.hta"
      },
      {
        "id": "",
        "name": "https://yip.su/ncikigovru.gif"
      },
      {
        "id": "",
        "name": "https://bsprofi.ru/profit.hta"
      },
      {
        "id": "",
        "name": "http://bti25.ru/openai.rtf"
      },
      {
        "id": "",
        "name": "https://yip.su/txttxt.jpg"
      },
      {
        "id": "",
        "name": "https://iplis.ru/camorra.gif"
      },
      {
        "id": "",
        "name": "http://update.ecols.ru/jquery-3.3.1.slim.min.xn--js-02t"
      },
      {
        "id": "",
        "name": "http://xn--e1ajbcejcefx.xn--p1ai/sflopytrgjklhfaseri"
      },
      {
        "id": "",
        "name": "http://zetag.ru/tramp.rtf"
      },
      {
        "id": "",
        "name": "http://ship-care.com/care.rtf"
      },
      {
        "id": "",
        "name": "http://aquacomplect.ru/complex.hta"
      },
      {
        "id": "",
        "name": "https://update.ecols.ru:8443/jquery-3.3.1.slim.min.js"
      },
      {
        "id": "",
        "name": "https://cba.abc92.ru:8443/jquery-3.3.1.slim.min.js"
      },
      {
        "id": "",
        "name": "https://valisi.ru/dosing.hta"
      },
      {
        "id": "",
        "name": "https://mcnn.ru:8443/jquery-3.3.1.slim.min.js"
      },
      {
        "id": "",
        "name": "https://ezstat.ru/kissmyass.gif"
      },
      {
        "id": "",
        "name": "http://krona77.ru/edr.hta"
      },
      {
        "id": "",
        "name": "http://vlasta-s.ru/logista.hta"
      },
      {
        "id": "",
        "name": "https://iplis.ru/penises.jpg"
      },
      {
        "id": "",
        "name": "http://aquacomplect.ru/aqua.docx"
      },
      {
        "id": "",
        "name": "900b32dac8335652db7243588dd01860d55a26b9b53376878bd7f73dd7abc564"
      },
      {
        "id": "",
        "name": "11577baef666fcf72f56fe5b47026ed6ece7b4ef63cbe593d888d01ac015fdbe"
      },
      {
        "id": "",
        "name": "5e68b88253e4f8bb83fc86b610390d28057d4656ec37e1ce3de5100129998df3"
      },
      {
        "id": "",
        "name": "4640c58e3c658d8178f4e9d9570566040ad162e25b61a46b0be989aeb69db679"
      },
      {
        "id": "",
        "name": "634b4bada49b67cada17ff361d45a6927ee69d3cc89fd197fa9a498b061a04bf"
      },
      {
        "id": "",
        "name": "57cd0102f13d317e70f7e91462d01b409146b42f4c8f929d14325ac5f91ff33e"
      },
      {
        "id": "",
        "name": "d329c1bbe548a412d3cfe3ee5605397d2c7366073df87d5829d3d448073d132b"
      },
      {
        "id": "",
        "name": "9612ad321eeedc9dd8c9aee9ec7286dc7bdb8614952c92eb33de9eecbf136c0a"
      },
      {
        "id": "",
        "name": "90b613cebceb8fd9a735f0daa496a01e457d8215d511bc7864c75e646a2e27c7"
      },
      {
        "id": "",
        "name": "799b31f43fac21f429bf11d94567834be8c24a8c2fb87a41306ba64fa123cc9c"
      },
      {
        "id": "",
        "name": "baa78cc8004de549b8ebe78ace9b5387a9870007694cf348ee6f2e8e81741d61"
      },
      {
        "id": "",
        "name": "4b39bce82f682c587ce0400c36e3502c10f1dc84e3a99875777b512cb48fec2a"
      },
      {
        "id": "",
        "name": "5ea495e5e401080510ee1b4a506a56c7a5cc24161277961949698c6738a5b3d0"
      }
    ],
    "malware": [
      {
        "id": "ab138766-9b64-4880-87fb-1942a709d778",
        "name": "Cobalt Strike - S0154",
        "slug": "cobalt-strike-s0154"
      }
    ],
    "attack_patterns": [
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "12f8e9b3-4b72-45d2-9989-f1171e6417ef",
        "name": "T1221"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2017-0199"
      },
      {
        "id": "",
        "name": "CVE-2017-11882"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Russian Federation"
      },
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Manufacturing"
      },
      {
        "id": "",
        "name": "Transport"
      },
      {
        "id": "",
        "name": "Construction"
      },
      {
        "id": "",
        "name": "update.ecols.ru"
      },
      {
        "id": "",
        "name": "gk-stst.ru"
      },
      {
        "id": "",
        "name": "effectovent.ru"
      },
      {
        "id": "",
        "name": "gemme-cotti.ru"
      },
      {
        "id": "",
        "name": "order.edrennikov.ru"
      },
      {
        "id": "",
        "name": "cba.abc92.ru"
      },
      {
        "id": "",
        "name": "impex-him.ru"
      },
      {
        "id": "",
        "name": "art.cse.ru"
      },
      {
        "id": "",
        "name": "ipgrabber.ru"
      },
      {
        "id": "",
        "name": "krona77.ru"
      },
      {
        "id": "",
        "name": "ekostroy33.ru"
      },
      {
        "id": "",
        "name": "toolhaus.ru"
      },
      {
        "id": "",
        "name": "xn--e1ajbcejcefx.xn--p1ai"
      },
      {
        "id": "",
        "name": "canature.su"
      },
      {
        "id": "",
        "name": "esetnod64.ru"
      },
      {
        "id": "",
        "name": "kzst45.ru"
      },
      {
        "id": "",
        "name": "incident.zilab.ru"
      },
      {
        "id": "",
        "name": "ship-care.com"
      },
      {
        "id": "",
        "name": "poopy.aarkhipov.ru"
      },
      {
        "id": "",
        "name": "bti25.ru"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/693709f10b18abd6b3644445",
    "https://www.seqrite.com/blog/operation-frostbeacon-multi-cluster-cobalt-strike-campaign-targets-russia/"
  ]
}