FrostyNeighbor: Fresh mischief and digital shenanigans

ESET researchers uncovered new activities attributed to FrostyNeighbor, updating its compromise chain to support the group’s continual cyberespionage operations

14 May 2026 • , 10 min. read

This blogpost covers newly discovered activities attributed to FrostyNeighbor, targeting governmental organizations in Ukraine. FrostyNeighbor has been running continual cyberoperations, changing and updating its toolset regularly, updating its compromise chain and methods to evade detection – targeting victims located in Eastern Europe, according to our telemetry.

Key points of the report:

• FrostyNeighbor is a long-running cyberespionage actor apparently aligned with the interests of Belarus.
• The group primarily targets governmental, military, and key sectors in Eastern Europe.
• This report documents new activity observed that started in March 2026, showing continued evolution of tooling and compromise chains.
• FrostyNeighbor uses server-side validation of its victims before delivering the final payload.
• The group has been active recently in campaigns targeting governmental organizations in Ukraine.

Introduction

FrostyNeighbor, also known as ...