GINC-APT-0721 · Targeted, sponsor unknown

FrostyNeighbor

Category
Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
Origin
Belarus(high confidence)
Sources
3 sources carry it
Identifier
GINC-APT-0721 · frostyneighbor

What it is

FrostyNeighbor is a Belarus-aligned APT group known for conducting influence and disinformation campaigns, particularly targeting Ukraine, Poland, and Lithuania. They have compromised various governmental and private sector entities, including the Polish Anti-Doping Agency, through hack-and-leak operations. The group is believed to collaborate with initial access brokers to exploit high-value targets, utilizing techniques such as zero-day vulnerabilities. Their operations are linked to cyber-enabled disinformation campaigns critical of the North Atlantic Alliance.

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Tools

The tools and malware families the sources tie to it.

  • Cyber Eye RAT
  • CyberGate
  • Xploit

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de