PicassoLoader
PicassoLoader is a payload downloader used by the Ghostwriter cluster, also tracked as UAC-0057, UNC1151, and FrostyNeighbor. It has been described by CERT-UA as a long-standing loader/downloader used to deliver follow-on payloads, most notably Cobalt Strike Beacon. Reported variants are implemented in .NET, PowerShell, JavaScript, and C++.
Observed delivery vectors include macro-enabled lure documents, malicious RAR archives, JavaScript droppers, and campaigns exploiting WinRAR vulnerability CVE-2023-38831. In one CERT-UA-described chain, a malicious archive triggered BAT/LNK/mshta-based execution, dropped a decoy PDF, and ran JavaScript assessed as a PicassoLoader variant that downloaded an SVG file containing an encrypted .NET payload, which was decrypted with the Rabbit algorithm and led to Cobalt Strike Beacon deployment. In later Ghostwriter/FrostyNeighbor campaigns, spearphishing emails with PDF lures impersonating Ukrtelecom led Ukrainian victims to geofenced delivery servers that returned RAR archives containing JavaScript-based PicassoLoader.
PicassoLoader’s documented behavior includes collecting host profiling data such as username, computer name, OS version, boot time, current time, and running processes, then sending that information to attacker-controlled servers via HTTP POST. In the 2026 FrostyNeighbor activity, the malware beaconed victim information every ten minutes, and operators appear to have manually decided whether to deliver a third-stage payload. If selected, victims received additional JavaScript or DLL stages culminating in Cobalt Strike Beacon. Reported persistence associated with these chains includes scheduled tasks and Windows Registry Run keys; one campaign copied rundll32.exe as ViberPC.exe and stored the beacon as ViberPC.dll.
Targeting described in the source material includes Ukrainian government organizations, military and defense entities, and local self-government-related personnel, as well as Belarusian opposition activists. Additional affected sectors in Poland and Lithuania include industrial, healthcare, logistics, and government organizations. High-confidence indicators mentioned in the content include files such as sdfhui2kjd.js, mokpp9342jktihh.dll, Update.js, certificate.js, 53_7.03.2026_R.js, and EdgeTaskMachine.js; infrastructure including windacarmelita[.]pw, topibuzz[.]space, book-happy.needbinding[.]icu, attachment-storage-asset-static.needbinding[.]icu, easiestnewsfromourpointofview.algsat[.]icu, mickeymousegamesdealer.alexavegas[.]icu, hinesafar.sardk[.]icu, and shinesafar.sardk[.]icu; and host artifacts such as %TMP%\sdfhui2kjd.js, %TMP%\mokpp9342jktihh.dll, %APPDATA%\Microsoft\runbll32.dll, %AppData%\Microsoft\ruhbll32.dll, and persistence via a scheduled task named "System service".
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Key developments include the deployment of multiple variants of the group’s main payload downloader, named PicassoLoader by CERT-UA. Variants of this downloader are written in .NET, PowerShell, JavaScript, and C++.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Згаданий JavaScript-файл, фактично, є варіантом реалізації функціоналу раніше використовуваного лоадеру PicassoLoader.
For Ukrainian IP addresses, it delivers a RAR archive containing a JavaScript file. This file executes a JavaScript version of PicassoLoader, the group's payload downloader, which collects system information and sends it to attacker-controlled servers.
Key developments include the deployment of multiple variants of the group’s main payload downloader, named PicassoLoader by CERT-UA. Variants of this downloader are written in .NET, PowerShell, JavaScript, and C++.
Key developments include the deployment of multiple variants of the group’s main payload downloader, named PicassoLoader by CERT-UA. Variants of this downloader are written in .NET, PowerShell, JavaScript, and C++.
Key developments include the deployment of multiple variants of the group’s main payload downloader, named PicassoLoader by CERT-UA. Variants of this downloader are written in .NET, PowerShell, JavaScript, and C++.
Techniques & procedures
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
3 techniquesTactic ID Name Resource Development T1583 Acquire Infrastructure
Tactic ID Name Resource Development T1583 Acquire Infrastructure T1608 Stage Capabilities
Initial Access
1 techniqueCERT-UA ... зафіксовано сплеск активності угрупування UAC-0057, що полягала в розповсюдженні документів з макросами ... Вміст виявлених файлів ... стосувався реформи органів місцевого самоврядування ... оподаткування, а також тематики фінансово-економічних показників.
Execution
6 techniques... документи з макросами, призначеними для запуску ... PICASSOLOADER ...
... розповсюдженні документів з макросами, призначеними для запуску на ЕОМ шкідливої програми PICASSOLOADER ...
та виконання JavaScript-коду, призначеного для завантаження зображення "113-1131910-clipart.svg", отримання за зміщенням та дешифрування за допомогою алгоритму Rabbit .NET-файлу
виявлено файл "Збірник_тез_НУОУ_23.rar", що містить експлойт для вразливості CVE-2023-38831, успішна експлуатація якої призведе до виконання BAT-файлу
... розповсюдженні документів з макросами, призначеними для запуску на ЕОМ шкідливої програми PICASSOLOADER ...
Persistence
2 techniquesPrivilege Escalation
2 techniquesStealth
5 techniquesDefense Evasion T1027 Obfuscated Files or Information
T1027.009 Obfuscated Files or Information: Embedded Payloads
The malware disguises rundll32.exe as ViberPC.exe to evade detection...
T1036.005 Masquerading: Match Legitimate Resource Name or Location
отримання за зміщенням та дешифрування за допомогою алгоритму Rabbit .NET-файлу
Discovery
2 techniques...collect the username, machine name, operating system version, boot time, and list of running processes, then report home every ten minutes via an HTTP POST request.
This file executes a JavaScript version of PicassoLoader, the group's payload downloader, which collects system information and sends it to attacker-controlled servers.
Command and Control
5 techniquesМережеві: backstagemerch[.]shop, empoweringparents[.]shop, lauramcinerney[.]shop ... https://backstagemerch.shop/the-simpsons/mens-freeze.html ...
Command and Control T1071.001 Application Layer Protocol: Web Protocols
JavaScript-коду, призначеного для завантаження зображення "113-1131910-clipart.svg"
...with responses disguised as image files while actually delivering XML configuration data.
Its command-and-control infrastructure hides behind Cloudflare using .icu and .buzz domains...
Exfiltration
1 techniqueThis file executes a JavaScript version of PicassoLoader, the group's payload downloader, which collects system information and sends it to attacker-controlled servers.
IOCs tracked for this family
118 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader malware used in a separate Ghostwriter campaign targeting Belarusian opposition activists and Ukrainian military and government entities via weaponized Excel documents.
Loader used by UAC-0057 (Ghostwriter).
A payload downloader used by FrostyNeighbor/Ghostwriter that collects system information and sends it to attacker-controlled servers, after which operators may choose to deliver a third-stage payload.
A long-standing payload downloader used by Ghostwriter/FrostyNeighbor. In this campaign, a JavaScript variant profiles the compromised host, collects system information such as username, machine name, OS version, boot time, and running processes, then reports to attacker-controlled servers every ten minutes. Based on operator review, it may receive and launch a further payload.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.