Frozenlake

Frozenlake, also known as APT28, Fancy Bear, Forest Blizzard, and several other names, is a threat actor believed to be sponsored by the Russian military. The group has been involved in numerous cyber-attacks, primarily targeting Ukraine's energy sector. Their modus operandi includes exploiting vulnerabilities such as the WinRAR flaw to deploy malware, often through sophisticated phishing operations. These campaigns have been observed throughout 2021, with notable global operations occurring in September and October. The group's activities were analyzed in detail by Mandiant, which identified Frozenlake's involvement in a global phishing operation conducted in late 2021. CERT-UA, Ukraine's computer emergency response team, also reported that Frozenlake exploited the WinRAR vulnerability to target energy infrastructure in September 2021. Furthermore, Frozenlake was linked to the distribution of IRONJAW malware, first observed in late July through early August, hosted on free hosting providers. Various cybersecurity entities have attributed attacks to Frozenlake. Microsoft referred to the group as Forest Blizzard (formerly Strontium), while others like Recorded Future identified their spear-phishing campaigns under the name BlueDelta. In addition to their primary focus on Ukraine, overlaps in victimology suggest some level of cooperation between Frozenlake and another Russian nation-state actor known as Sofacy. The group has also been associated with the exploitation of CVE-2023-38831, a vulnerability used in a campaign against Ukraine’s energy infrastructure.