Operation FrostBeacon Attacking Finance and Legal Departments with Cobalt Strike Malware
## Cybersecurity: Operation FrostBeacon Malware Campaign
Cybersecurity: Operation FrostBeacon Malware Campaign
A recent malware campaign, identified as Operation FrostBeacon, is targeting the financial and legal sectors in the Russian Federation. The campaign employs the Cobalt Strike remote access tool, aiming at organizations involved in sensitive business transactions.
Operation FrostBeacon utilizes a multi-stage attack chain with over twenty initial infection files. The campaign employs phishing emails with weaponized attachments to compromise its targets. The phishing messages often reference contract payments, legal disputes, and debt collection, exploiting common business concerns in logistics, finance, and supply chain sectors.
Security analysts have identified two distinct infection clusters operating in parallel, each delivering the same malware. The first cluster uses archive delivery, featuring a malicious shortcut file disguised as a PDF. Upon opening, it triggers hidden PowerShell commands to connect to a remote server.
The second cluster uses Word documents exploiting legacy vulnerabilities, specifically CVE-2017-0199 and CVE-2017-11882. Both clusters redirect to an HTML Application (HTA) file, which serves as the core execution component.
A recent malware campaign, identified as Operation FrostBeacon, is targeting the financial and legal sectors in the Russian Federation.
The HTA file reconstructs multiple Base64-encoded blocks into a gzip-compressed PowerShell script. This script uses several layers of obfuscation:
The first layer employs Gzip compression and Base64 encoding. The second layer uses custom functions to resolve Windows APIs without writing to disk. The final layer utilizes a Base64-encoded blob XOR-encrypted with key 35, decoding into raw shellcode executed in memory.
The decrypted shellcode functions as a Cobalt Strike Beacon loader, facilitating communication with command-and-control servers disguised as jQuery file downloads.
Advanced techniques, such as NtMapViewOfSection for process injection and customized Cobalt Strike profiles, are employed to further obscure the malware's presence. An infrastructure analysis indicates that Russian-controlled domains registered through local providers are used, with command-and-control traffic hidden within legitimate web requests.
This operation demonstrates a financially motivated threat group with substantial technical expertise in evasion methods.
Based on reporting by Cyber Security News.