FrostyNeighbor Attacks: Hackers Abuse Scheduled Tasks for Persistence

Key Takeaways

• The state-aligned hacking group FrostyNeighbor has launched a sophisticated new campaign targeting Ukrainian government entities.
• The attacks utilize spearphishing with malicious PDFs, a multi-stage infection chain, and server-side victim filtering to deploy the PicassoLoader downloader and ultimately a Cobalt Strike beacon.
• FrostyNeighbor employs scheduled tasks and registry modifications for persistence, making detection and eradication challenging.
• The group demonstrates a highly selective approach, delivering the final payload only after manual validation of high-value targets.

The state-sponsored cyberespionage group known as FrostyNeighbor, also tracked by various aliases including Ghostwriter, UNC1151, TA445, PUSHCHA, and Storm-0257, has initiated a sophisticated new wave of attacks against Ukrainian government organizations. Active since at least 2016, this Belarus-aligned threat actor has consistently refined its tactics, techniques, and procedures (TTPs), making its latest campaign particularly evasive and difficult to uncover.

Beginning in March 2026, the current operation integrates deceptive documents, multi-layered malware scripts, and a critical server-side victim filtering mechanism. This coordinated approach allows the attackers to maintain a low profile and ensure that their high-value payloads are only delivered to truly desirable targets, as detailed in a recent report.

Initial Infection Chain and Deception

The attack sequence commences with spearphishing emails containing malicious PDF attachments. These documents are meticulously crafted to appear as authentic government communications. For instance, one observed lure mimicked official correspondence from Ukrtelecom, a major Ukrainian telecommunications provider, promising assurances regarding customer data protection.

When a recipient interacts with a download button embedded within the malicious PDF, they are redirected to a server controlled by the attackers. Crucially, the subsequent payload delivered to the victim is contingent upon their geographical location and other identifiable characteristics, indicating a precise targeting strategy.

ESET’s threat research blog, WeLiveSecurity, shared insights with Cyber Security News (CSN), emphasizing FrostyNeighbor’s continuous development of tools and methods specifically designed to circumvent security alerts. Historically, FrostyNeighbor’s campaigns have focused on entities within Ukraine, Poland, and Lithuania, encompassing a broad spectrum of targets from government and military bodies to industrial firms and healthcare organizations.

This latest campaign underscores the group’s patience and precision. The final, most potent payload is only deployed after a manual confirmation process, wherein human operators assess the target’s value. This selective methodology poses significant challenges for detection and replication within sandboxed environments, further complicating defensive efforts.

Security researchers have been actively monitoring FrostyNeighbor for years, with past reports from CERT-UA, SentinelOne, HarfangLab, and StrikeReady consistently documenting the evolution of their TTPs. Recent findings highlight a new delivery mechanism that leverages JavaScript to stage the attack across multiple steps, discreetly fetching tools disguised as benign image or web files.

Hackers Abuse Scheduled Tasks

Upon a Ukrainian victim clicking the embedded link in the initial PDF lure, the attacker’s server delivers a RAR archive named 53_7.03.2026_R.rar. Inside this archive is a JavaScript file that executes in two stages. First, it drops a decoy PDF to distract the user, while simultaneously launching the next stage in the background. This second-stage script, known as PicassoLoader, is a versatile downloader previously observed in multiple FrostyNeighbor campaigns, implemented in various programming languages.

To establish persistence on the compromised system, PicassoLoader retrieves a scheduled task template from its command-and-control (C2) server. This template is cleverly disguised as a JPEG image file but is, in fact, an XML configuration file. The script then populates this XML with actual execution parameters and registers the scheduled task on the victim’s machine. This strategic use of scheduled tasks ensures that PicassoLoader automatically executes with every Windows startup, providing FrostyNeighbor with reliable and persistent access to the compromised endpoint.

Cobalt Strike Deployed After Victim Validation

A distinctive and highly effective aspect of this attack chain is the server-side validation that precedes the deployment of any high-impact payload. Every ten minutes, PicassoLoader transmits a system fingerprint to the C2 server. This fingerprint includes critical information such as the username, computer name, operating system version, and a list of currently running processes. A human operator then meticulously reviews this data to determine if the target warrants further exploitation.

Should the victim be deemed valuable, the C2 server responds by delivering a third-stage JavaScript dropper. This script takes an additional measure to evade detection by copying the legitimate Windows executable rundll32.exe under an altered filename. This tactic aims to bypass security solutions that might flag unfamiliar executables. Subsequently, a Cobalt Strike beacon is written to disk, and a corresponding registry entry is created to ensure its automatic launch at every system startup. This final stage grants the attackers full, persistent remote control over the compromised machine.

What You Should Do

• Educate Users: Conduct regular training on identifying spearphishing attempts, especially those involving unsolicited PDF attachments or links that lead to external downloads.
• Implement Email Security: Deploy advanced email gateway solutions with robust attachment scanning, URL sandboxing, and DMARC, DKIM, and SPF authentication to filter out malicious emails.
• Endpoint Detection and Response (EDR): Utilize EDR solutions to monitor for suspicious activities like the creation of new scheduled tasks, unusual process execution (e.g., rundll32.exe renamed), and beaconing activity to known C2 infrastructure.
• Network Segmentation and Filtering: Implement network segmentation to limit lateral movement and deploy robust network filtering to block connections to known malicious domains and IP addresses.
• Monitor Scheduled Tasks and Registry: Regularly audit scheduled tasks and registry entries for unauthorized modifications, especially those configured for automatic startup.
• Threat Intelligence Integration: Integrate the provided Indicators of Compromise (IoCs) into your security information and event management (SIEM) systems, firewalls, and endpoint protection platforms for proactive detection and blocking.

Indicators of Compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.