FrostBeacon Hits Russian B2B: Cobalt Strike Deployed via LNK and Chained Legacy Exploits

A new cyber campaign dubbed “Operation FrostBeacon” is targeting business-to-business (B2B) enterprises across the Russian Federation, with Seqrite Labs describing a dual infection strategy that culminates in deploying Cobalt Strike beacons for persistent access. The campaign uses two infection clusters: the first relies on phishing emails that deploy hidden LNK shortcuts designed to masquerade as PDFs, triggering a PowerShell command that downloads the next stage from a remote server.

The second cluster exploits legacy vulnerabilities, including CVE-2017-0199 and CVE-2017-11882, by nesting exploits in DOCX and RTF documents to execute code after a user opens the file. According to Seqrite Labs, both paths converge on launching a remote HTML Application file and a highly obfuscated PowerShell loader that downloads a stager and injects into a legitimate process, enabling a Cobalt Strike beacon.

Victims are principally in logistics, industrial production and construction, with the actors using Russian‑controlled infrastructure and targeting organisations handling payments, contracts and reconciliation.