FrostyNeighbor: Fresh mischief and digital shenanigans

This blogpost covers newly discovered activities attributed to FrostyNeighbor, targeting governmental organizations in Ukraine. FrostyNeighbor has been running continual cyberoperations, changing and updating its toolset regularly, updating its compromise chain and methods to evade detection – targeting victims located in Eastern Europe, according to our telemetry.

Key points of the report:

FrostyNeighbor is a long-running cyberespionage actor apparently aligned with the interests of Belarus.

The group primarily targets governmental, military, and key sectors in Eastern Europe.

This report documents new activity observed that started in March 2026, showing continued evol…