# Cold lures, hot targets. [Research Saturday]

Page: https://stenobird.com/podcast/cyberwire-daily-454880/cold-lures-hot-targets-research-saturday
Text version: https://stenobird.com/podcast/cyberwire-daily-454880/cold-lures-hot-targets-research-saturday.md
Podcast: [CyberWire Daily](https://stenobird.com/podcast/cyberwire-daily-454880)
Published: 2026-07-25T07:00:00+00:00
Episode link: https://thecyberwire.com/podcasts/research-saturday/434/notes
Audio file: https://pdst.fm/e/pdrl.fm/85df76/traffic.megaphone.fm/CYBW8901898338.mp3?updated=1743778764
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/cyberwire-daily-454880/episodes/cold-lures-hot-targets-research-saturday
Duration seconds: 1023

## Resource

This week, we are joined by Ondrej Kubovič, Security Awareness Specialist from ESET, discussing their work on "FrostyNeighbor: Fresh mischief and digital shenanigans." Ondrej walks us through ESET's latest research into FrostyNeighbor, a long-running Belarus-aligned cyberespionage group that has continued to target Ukrainian government organizations with increasingly sophisticated spearphishing campaigns. We discuss how the group uses malicious PDF lures, server-side victim validation, and an updated JavaScript-based malware chain to selectively deploy espionage tools, demonstrating its ongoing efforts to evade detection while compromising high-value targets across Eastern Europe. The research and executive brief can be found here: ⁠FrostyNeighbor: Fresh mischief and digital shenanigans

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/cyberwire-daily-454880/episodes/cold-lures-hot-targets-research-saturday/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/cyberwire-daily-454880/cold-lures-hot-targets-research-saturday.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.