Frozenlake

Threat Actor updated 15 days ago (2024-11-29T14:33:26.320Z)
Download STIX
Preview STIX
Frozenlake, also known as APT28, Fancy Bear, Forest Blizzard, and several other names, is a threat actor believed to be sponsored by the Russian military. The group has been involved in numerous cyber-attacks, primarily targeting Ukraine's energy sector. Their modus operandi includes exploiting vulnerabilities such as the WinRAR flaw to deploy malware, often through sophisticated phishing operations. These campaigns have been observed throughout 2021, with notable global operations occurring in September and October. The group's activities were analyzed in detail by Mandiant, which identified Frozenlake's involvement in a global phishing operation conducted in late 2021. CERT-UA, Ukraine's computer emergency response team, also reported that Frozenlake exploited the WinRAR vulnerability to target energy infrastructure in September 2021. Furthermore, Frozenlake was linked to the distribution of IRONJAW malware, first observed in late July through early August, hosted on free hosting providers. Various cybersecurity entities have attributed attacks to Frozenlake. Microsoft referred to the group as Forest Blizzard (formerly Strontium), while others like Recorded Future identified their spear-phishing campaigns under the name BlueDelta. In addition to their primary focus on Ukraine, overlaps in victimology suggest some level of cooperation between Frozenlake and another Russian nation-state actor known as Sofacy. The group has also been associated with the exploitation of CVE-2023-38831, a vulnerability used in a campaign against Ukraine’s energy infrastructure.
Description last updated: 2024-05-04T20:27:56.950Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Phishing
Vulnerability
Malware
Decoy
WinRAR
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Threat Actors
To see the evidence that has resulted in these threatActor associations, create a free account
Alias DescriptionAssociation TypeVotes
The APT28 Threat Actor is associated with Frozenlake. APT28, also known as Fancy Bear, Pawn Storm, Sofacy Group, Sednit, and STRONTIUM, is a threat actor linked to Russia. The group has been associated with cyber espionage campaigns across Central Asia and has historically targeted areas of national security, military operations, and geopolitical influhas used
5
The Sandworm Threat Actor is associated with Frozenlake. Sandworm, a threat actor linked to Russia, has been identified as the primary cyber attack unit supporting Russian military activities in Ukraine. This group is notorious for its sophisticated and disruptive cyber attacks, including the compromise of 11 Ukrainian telecommunications providers which cUnspecified
2
The Forest Blizzard Threat Actor is associated with Frozenlake. Forest Blizzard, also known as APT28, Fancy Bear, and Strontium, is a notorious threat actor linked to Russia. In April 2022, this group gained control over a botnet which was then employed for persistent espionage campaigns. The group has shown consistent and lasting repetitions in its tactics, techas used
2
Source Document References
Information about the Frozenlake Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more