Likely Belarus-Nexus Threat Actor Delivers Downloader to Poland

A malicious CHM file targeting Poland was discovered, containing an infection chain that drops and executes a C++ downloader. The CHM file displays a decoy image while executing obfuscated JavaScript to extract and run a DLL. The downloader retrieves a payload from a domain associated with previous Belarus-linked threat activities. The payload is encrypted and appended to an image file. The infection process involves multiple stages, including the use of LOLbins and the creation of a scheduled task for persistence. This campaign shows similarities to activities attributed to threat actors like FrostyNeighbor and UNC1151, known for targeting Eastern European countries.

• From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection ChainCampaign2026-09-21
• TerminalFix campaign deploys a reverse tunnel through multistage intrusionMalware2026-08-29
• Phantom Stealer Unmasked: Shellcode, Steganography, and Credential TheftMalware2026-07-29
• ACR Stealer: Two observed intrusion chains amid increased threat activityMalware2026-07-17
• Contagious Interview malware in SVG images: DPRK campaignMalware2026-07-17