Hackers Abuse Scheduled Tasks to Maintain Persistence in FrostyNeighbor Attacks

A state-aligned hacking group known as FrostyNeighbor has resurfaced with a fresh wave of cyberattacks targeting government organizations in Ukraine, using a carefully designed infection chain that is harder than ever to detect.

The group, active since at least 2016, has a long history of targeting countries neighboring Belarus, and its latest campaign shows just how far it has evolved.

The new activity, detected starting in March 2026, blends deceptive documents, layered malware scripts, and server-side victim filtering into a single coordinated operation.

The attacks begin with spearphishing emails carrying malicious PDF files designed to look like legitimate government communications.

One lure document impersonated Ukrtelecom, a Ukrainian telecommunications company, and appeared to offer assurances about customer data protection.

When a recipient clicks the download button inside the PDF, they are directed to a server fully controlled by the attackers. What they receive next depends entirely on where they are connecting from.

ESET’s official threat research blog, WeLiveSecurity’s analysts identified and said in a report shared with Cyber Security News (CSN) that FrostyNeighbor, also tracked as Ghostwriter, UNC1151, TA445, PUSHCHA, and Storm-0257, is a long-running cyber espionage actor apparently aligned with the interests of Belarus.

ESET researchers noted that the group regularly updates its tools and methods specifically to avoid triggering security alerts.

FrostyNeighbor’s campaigns have historically focused on Ukraine, Poland, and Lithuania, with victims ranging from government and military bodies to industrial firms and healthcare organizations.

In its newest campaign, the group demonstrates both patience and precision, delivering the final payload only after manually confirming that a target is worth pursuing.

This selective approach makes the operation especially difficult to detect or replicate in a controlled environment.

The group has been under active surveillance for years, with past reports from CERT-UA, SentinelOne, HarfangLab, and StrikeReady all documenting its evolving tactics.

The latest findings reveal a newer delivery mechanism using JavaScript to stage the attack across multiple steps, pulling in tools cleverly disguised as ordinary image or web files.

Hackers Abuse Scheduled Tasks

Once a victim from Ukraine clicks the embedded link in the lure document, the attacker’s server delivers a RAR archive named 53_7.03.2026_R.rar.

Inside is a JavaScript file that drops a decoy PDF to keep the target occupied while quietly launching the next stage in the background.

This second-stage script, called PicassoLoader, is a downloader the group has used across multiple campaigns and in several different programming languages.

To lock in its presence on the victim’s machine, PicassoLoader downloads a scheduled task template from the command-and-control server, disguised as a JPEG image file.

The server actually delivers an XML configuration file, and the script fills in real execution parameters before registering the scheduled task on the system.

This ensures PicassoLoader runs automatically at every Windows startup, which is exactly how FrostyNeighbor maintains persistent access on compromised machines.

Cobalt Strike Deployed After Victim Validation

What makes this attack chain particularly sharp is the server-side validation step that occurs before any serious payload is delivered.

Every ten minutes, PicassoLoader sends a system fingerprint, including the username, computer name, operating system version, and list of running processes, to the command-and-control server.

A human operator then reviews this information and decides whether the target is worth the next move.

If the victim qualifies, the server responds with a third-stage JavaScript dropper. This script copies the legitimate Windows file rundll32.exe under a different name, likely to bypass security tools that flag unfamiliar executables.

A Cobalt Strike beacon is then written to disk, and a registry entry ensures it launches automatically on every startup, giving the attackers full and persistent remote control over the compromised machine.

Security researchers recommend continuous and close monitoring of the group’s infrastructure, toolset changes, and operational patterns as the most effective defense against future campaigns.

Organizations across Eastern Europe, especially those in government, defense, and critical sectors, should treat any unsolicited PDF attachment as a potential threat and remain on high alert.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.