FrostyNeighbor: Fresh mischief and digital shenanigans

FrostyNeighbor, a long-running cyberespionage group allegedly linked to Belarus, is continuing its operations targeting governmental organizations in Ukraine and other Eastern European countries. The latest activity involves a sophisticated new compromise chain utilizing a server-side validation process to determine if a victim is of interest, followed by a multi-stage attack leveraging a JavaScript-based downloader (PicassoLoader) to deliver a Cobalt Strike beacon. The group employs a variety of lure documents and techniques to evade detection and maintain persistence, demonstrating a high level of operational maturity.