Hackers Exploit Scheduled Tasks for Persistence in FrostyNeighbor Attacks

Hackers linked to the long-running FrostyNeighbor cyber‑espionage group have intensified attacks against Ukrainian government organizations, deploying updated techniques that rely on scheduled tasks for stealthy persistence and server-side validation to evade detection.

FrostyNeighbor also tracked as Ghostwriter, UNC1151, and TA445 has been active since at least 2016 and is widely believed to operate in alignment with Belarusian state interests.

The group primarily targets government, military, and strategic sectors across Eastern Europe, with a strong focus on Ukraine, Poland, and Lithuania.

According to recent telemetry, its campaigns have continued to evolve rapidly, with new activity observed beginning in March 2026.

A key evasion technique involves server-side validation. Victims outside Ukraine receive a benign decoy PDF, while targeted users within Ukraine are served a malicious RAR archive. This archive contains a JavaScript file that launches the infection process.

ESET researchers uncovered new activities attributed to FrostyNeighbor, updating its compromise chain to support the group’s continual cyberespionage operations.

Once executed, the script drops a decoy document to avoid suspicion while simultaneously deploying a JavaScript-based version of PicassoLoader a malware downloader previously associated with FrostyNeighbor.

This loader ultimately delivers a Cobalt Strike beacon, giving attackers full remote control over compromised systems.

Hackers Exploit Scheduled Tasks

A notable enhancement in this campaign is the abuse of Windows scheduled tasks to maintain persistence.

The latest campaign begins with spear-phishing emails containing malicious PDF attachments that impersonate Ukraine’s telecom provider, Ukrtelecom. The lure document, titled “53_7.03.2026_R.pdf,” contains a download link that initiates a multi-stage infection chain.

After initial execution, the malware retrieves what appears to be a JPG file from a remote server. In reality, the response contains XML data defining a scheduled task configuration.

The malware dynamically inserts execution parameters into this template and registers the task on the infected system.

This ensures that the malicious downloader is re-executed automatically, even after system reboots, allowing attackers to maintain long-term access.

For example, instead of dropping obvious startup entries, the attackers embed commands within scheduled task XML fields like execution boundaries and arguments making detection significantly harder for traditional security tools.

PicassoLoader performs detailed system reconnaissance before deploying the final payload. It collects host data such as username, OS version, running processes, and system uptime, sending this information to a command-and-control (C2) server every 10 minutes.

Importantly, the final payload is not delivered automatically. Instead, attackers appear to assess the victim’s value manually. Only high-interest targets receive the next-stage JavaScript, which installs a Cobalt Strike beacon.

This selective deployment reduces exposure and helps the group remain under the radar.

To further evade detection, FrostyNeighbor leverages legitimate system tools. In the final stage:

• rundll32.exe is copied and renamed to masquerade as a legitimate application.
• A malicious DLL payload is dropped and executed via the renamed binary.
• Persistence is reinforced using registry Run keys and shortcut files.

The final Cobalt Strike beacon connects to attacker-controlled infrastructure, enabling command execution, lateral movement, and data exfiltration.

FrostyNeighbor has consistently refined its toolset, previously using CHM, DOC, and XLS lures, exploiting vulnerabilities like CVE‑2023‑38831 in WinRAR and CVE‑2024‑42009 in Roundcube. The group has also abused platforms like Slack and Canarytokens to track victims and deliver payloads.

The latest campaign highlights a shift toward more modular, stealthy techniques combining geofencing, scheduled task abuse, and manual victim validation.

Security researchers warn that this adaptability makes FrostyNeighbor a persistent threat across Eastern Europe.

Organizations, especially in government and defense sectors, are urged to monitor scheduled task anomalies, inspect outbound connections, and apply strict email filtering to mitigate risk.

IOCs

SHA‑1	Filename	Detection	Description
776A43E46C36A539C916ED426745EE96E2392B39	53_7.03.2026_R.rar	JS/TrojanDropper.FrostyNeighbor.E	Lure RAR archive.
8D1F2A6DF51C7783F2EAF1A0FC0FF8D032E5B57F	53_7.03.2026_R.js	JS/TrojanDropper.FrostyNeighbor.E	JavaScript dropper.
B65551D339AECE718EA1465BF3542C794C445EFC	Update.js	JS/TrojanDownloader.FrostyNeighbor.D	JavaScript PicassoLoader downloader.
E15ABEE1CFDE8BE7D87C7C0B510450BAD6BC0906	Update.js	JS/TrojanDropper.FrostyNeighbor.D	Cobalt Strike dropper.
43E30BE82D82B24A6496F6943ECB6877E83F88AB	ViberPC.dll	Win32/CobaltStrike.Beacon.S	Cobalt Strike beacon.
4F2C1856325372B9B7769D00141DBC1A23BDDD14	53_7.03.2026_R.pdf	PDF/TrojanDownloader.FrostyNeighbor.D	Lure PDF document.
D89E5524E49199B1C3B66C524E7A63C3F0A0C199	Certificate.pdf	PDF/TrojanDownloader.FrostyNeighbor.E	Lure PDF document.
7E537D8E91668580A482BD77A5A4CABA26D6BDAC	certificate.js	JS/TrojanDownloader.FrostyNeighbor.G	JavaScript PicassoLoader downloader.
FA6882672AD3654800987613310D7C3FBADE027E	certificate.js	JS/TrojanDownloader.FrostyNeighbor.E	JavaScript PicassoLoader downloader.
3FA7D1B13542F1A9EB054111F9B69C250AF68643	Сетифікат_CAF.rar	JS/TrojanDropper.FrostyNeighbor.G	Lure RAR archive.
4E52C92709A918383E90534052AAA257ACE2780C	Сетифікат_CAF.js	JS/TrojanDropper.FrostyNeighbor.G	JavaScript dropper.
6FDED427A16D5314BA3E1EB9AFD120DC84449769	EdgeTaskMachine.js	JS/TrojanDropper.FrostyNeighbor.F	JavaScript PicassoLoader downloader.
27FA11F6A1D653779974B6FB54DE4AF47F211232	EdgeSystemConfig.dll	Win32/CobaltStrike.Beacon.S	Cobalt Strike beacon.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.