Nation-State
Frostbyte campaign pivots from energy to EU finance regulators
The espionage cluster tracked as Frostbyte is now sending tailored lures to supervisory staff at three national financial authorities.
/ 7 min read
Frostbyte spent most of the summer targeting energy grid operators. Since late September its infrastructure has been used against financial supervisors in at least three EU member states.
The lures impersonate consultation documents on payment regulation. Opening them launches a loader that beacons over HTTPS every 60 seconds with light jitter.
Analysts link the activity to a cluster previously associated with a foreign intelligence service, based on shared certificates and code overlaps.
Filed under Malware & ThreatsNation-State
Tell us about your environment and a SentriXa security editor will get back to you within one business day.