Seqrite Labs has uncovered a sophisticated malware campaign targeting business-to-business (B2B) enterprises within the Russian Federation.
Dubbed “Operation FrostBeacon,” the campaign zeroes explicitly in on finance and legal departments the very heart of corporate operations responsible for payments, contracts, and risk management.
According to researchers, the threat group appears to be financially motivated and highly targeted.
The attackers are deploying Cobalt Strike beacons, a powerful post-exploitation tool often used by advanced adversaries to maintain persistent access to compromised networks.
The campaign is notable for its use of dual-infection clusters, legacy-vulnerability exploitation, and a convincing social-engineering strategy designed to deceive corporate professionals.
The Attack Strategy: Two Paths, One Goal
Operation FrostBeacon utilizes two distinct methods to breach organizations, both designed to bypass standard defenses and trick users into executing malicious code.
1. The LNK Cluster (Phishing Archives):
The first method involves phishing emails containing a ZIP archive named “рекламация.zip” (translating to “complaint” or “claim”).
Inside, victims find a decoy Excel workbook and a malicious LNK file disguised as a PDF. The emails are carefully crafted to mimic routine B2B correspondence, referencing contract payments, debt collection, and reconciliation statements topics that compel finance and legal staff to open attachments immediately.
When a user clicks the disguised LNK file, it does not open a local document. Instead, it triggers a hidden PowerShell command that reaches out to a remote server (e.g., ezstat[.]ru), downloading a malicious HTA file.
This file then launches a multi-layered, obfuscated PowerShell loader that decrypts shellcode in memory, eventually deploying the Cobalt Strike beacon without ever writing the malware to the disk.
2. The CVE Cluster (Legacy Vulnerabilities):
The second infection path exploits older software vulnerabilities. Attackers send malicious Microsoft Word documents that leverage CVE-2017-0199 (remote template injection).
Once opened, these documents frequently download an RTF file that exploits CVE-2017-11882, a vulnerability in the Microsoft Equation Editor.
The attacker triggers mshta.exe through character-level obfuscation (m^s^h^t^a) to evade straightforward detections.
Despite these flaws being years old, they remain effective against unpatched systems. Like the LNK cluster, this chain triggers the execution of a remote HTA file, leading to the same end result: a Cobalt Strike infection.
Infrastructure and Attribution
Seqrite Labs observed over 20 initial infection files and identified a vast infrastructure of Russian-controlled domains used for command-and-control (C2) communication.
Inside this second-stage script is the third and final layer: a Base64-encoded blob stored in the variable $v_code. After decoding, the script performs a byte-wise XOR operation with the key 35.
Domains such as update. ecols[.]ru and aquacomplect[.]ru were found hosting malicious payloads.
The technical analysis reveals a high level of tradecraft. The malware uses complex obfuscation techniques, including nested Base64 encoding and XOR encryption, to evade detection by Endpoint Detection and Response (EDR) systems.
The Cobalt Strike profiles are customized to blend in with legitimate web traffic, masquerading as jQuery scripts to hide their communications.
While the tactics, techniques, and procedures (TTPs) share similarities with the notorious Cobalt Group, which historically targeted financial institutions globally, Seqrite Labs has not yet definitively linked Operation FrostBeacon to that specific group.
However, the evidence points strongly to a Russian-speaking, financially motivated cybercrime entity.
This campaign highlights the persistent danger of “living-off-the-land” attacks and the exploitation of unpatched software.
Security experts recommend that organizations, particularly those in the logistics and industrial sectors:
- Patch Legacy Vulnerabilities: Ensure all Microsoft Office and Windows systems are patched against CVE-2017-0199 and CVE-2017-11882.
- Verify Email Attachments: Train staff to scrutinize emails requesting urgent payments or legal action, especially those containing ZIP or LNK files.
- Monitor PowerShell Activity: Restrict and monitor PowerShell usage, particularly scripts executing hidden windows or reaching out to external IP addresses.
As Operation FrostBeacon continues to evolve, vigilance remains the best defense against these stealthy, finance-focused attacks.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 enterprises within the Russian Federation.){kind=link}