{"id":12892,"date":"2026-05-15T10:04:04","date_gmt":"2026-05-15T10:04:04","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/05\/15\/hackers-abuse-scheduled-tasks-to-maintain-persistence-in-frostyneighbor-attacks\/"},"modified":"2026-05-15T10:04:04","modified_gmt":"2026-05-15T10:04:04","slug":"hackers-abuse-scheduled-tasks-to-maintain-persistence-in-frostyneighbor-attacks","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/05\/15\/hackers-abuse-scheduled-tasks-to-maintain-persistence-in-frostyneighbor-attacks\/","title":{"rendered":"Hackers Abuse Scheduled Tasks to Maintain Persistence in FrostyNeighbor Attacks"},"content":{"rendered":"

Hackers Abuse Scheduled Tasks to Maintain Persistence in FrostyNeighbor Attacks
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A state-aligned hacking group known as FrostyNeighbor has resurfaced with a fresh wave of cyberattacks targeting government organizations in Ukraine, using a carefully designed infection chain that is harder than ever to detect. <\/p>\n

The group, active since at least 2016, has a long history of targeting countries neighboring Belarus, and its latest campaign shows just how far it has evolved. <\/p>\n

The new activity, detected starting in March 2026, blends deceptive documents, layered malware scripts, and server-side victim filtering into a single coordinated operation.<\/a><\/p>\n

The attacks begin with spearphishing emails carrying malicious PDF files<\/a> designed to look like legitimate government communications. <\/p>\n

One lure document impersonated Ukrtelecom, a Ukrainian telecommunications company, and appeared to offer assurances about customer data protection. <\/p>\n

When a recipient clicks the download button inside the PDF, they are directed to a server fully controlled by the attackers. What they receive next depends entirely on where they are connecting from.<\/a><\/p>\n

ESET\u2019s official threat research blog,\u00a0WeLiveSecurity\u2019s analysts identified and said in a report shared with <\/a>Cyber Security News (CSN)<\/a> that FrostyNeighbor, also tracked as Ghostwriter, UNC1151, TA445, PUSHCHA, and Storm-0257, is a long-running cyber espionage actor apparently aligned with the interests of Belarus. <\/p>\n

ESET researchers noted that the group regularly updates its tools and methods specifically to avoid triggering security alerts.<\/a><\/p>\n

FrostyNeighbor\u2019s campaigns have historically focused on Ukraine, Poland, and Lithuania, with victims ranging from government and military bodies to industrial firms and healthcare organizations. <\/p>\n

\n
\"Compromise
Compromise chain overview (Source \u2013 Welivesecurity)<\/figcaption><\/figure>\n<\/div>\n

In its newest campaign, the group demonstrates both patience and precision, delivering the final payload only after manually confirming that a target is worth pursuing. <\/p>\n

This selective approach makes the operation especially difficult to detect or replicate in a controlled environment.<\/a><\/p>\n

The group has been under active surveillance for years<\/a>, with past reports from CERT-UA, SentinelOne, HarfangLab, and StrikeReady all documenting its evolving tactics. <\/p>\n

The latest findings reveal a newer delivery mechanism using JavaScript to stage the attack across multiple steps, pulling in tools cleverly disguised as ordinary image or web files.<\/a><\/p>\n

Hackers Abuse Scheduled Tasks<\/strong><\/h2>\n

Once a victim from Ukraine clicks the embedded link in the lure document, the attacker\u2019s server delivers a RAR archive named 53_7.03.2026_R.rar. <\/p>\n

Inside is a JavaScript file that drops a decoy PDF to keep the target occupied while quietly launching the next stage in the background. <\/p>\n

This second-stage script, called PicassoLoader, is a downloader the group has used across multiple campaigns and in several different programming languages.<\/a><\/p>\n

To lock in its presence on the victim\u2019s machine, PicassoLoader downloads a scheduled task template from the command-and-control server, disguised as a JPEG image file. <\/p>\n

The server actually delivers an XML configuration file, and the script fills in real execution parameters before registering the scheduled task on the system. <\/p>\n

\n
\"Scheduled
Scheduled task template downloaded from the C&C server (Source \u2013 Welivesecurity)<\/figcaption><\/figure>\n<\/div>\n

This ensures PicassoLoader runs automatically at every Windows startup, which is exactly how FrostyNeighbor maintains persistent access on compromised machines.<\/a><\/p>\n

Cobalt Strike Deployed After Victim Validation<\/strong><\/h2>\n

What makes this attack chain particularly sharp is the server-side validation step that occurs before any serious payload is delivered. <\/p>\n

Every ten minutes, PicassoLoader sends a system fingerprint, including the username, computer name, operating system version, and list of running processes, to the command-and-control server. <\/p>\n

A human operator then reviews this information and decides whether the target is worth the next move.<\/a><\/p>\n

If the victim qualifies, the server responds with a third-stage JavaScript dropper<\/a>. This script copies the legitimate Windows file rundll32.exe under a different name, likely to bypass security tools that flag unfamiliar executables. <\/p>\n

A Cobalt Strike beacon is then written to disk, and a registry entry ensures it launches automatically on every startup, giving the attackers full and persistent remote control over the compromised machine.<\/a><\/p>\n

Security researchers recommend continuous and close monitoring of the group\u2019s infrastructure, toolset changes, and operational patterns as the most effective defense against future campaigns. <\/p>\n

Organizations across Eastern Europe, especially those in government, defense, and critical sectors, should treat any unsolicited PDF attachment as a potential threat and remain on high alert.<\/a><\/p>\n

Indicators of Compromise (IoCs):-<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Type<\/th>\nIndicator<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
SHA-1<\/td>\n776A43E46C36A539C916ED426745EE96E2392B39<\/td>\n53_7.03.2026_R.rar \u2014 JS\/TrojanDropper.FrostyNeighbor<\/td>\n<\/tr>\n
SHA-1<\/td>\n8D1F2A6DF51C7783F2EAF1A0FC0FF8D032E5B57F<\/td>\n53_7.03.2026_R.js \u2014 JS\/TrojanDropper.FrostyNeighbor<\/td>\n<\/tr>\n
SHA-1<\/td>\nB65551D339AECE718EA1465BF3542C794C445EFC<\/td>\nUpdate.js \u2014 JS\/TrojanDownloader.FrostyNeighbor<\/td>\n<\/tr>\n
SHA-1<\/td>\nE15ABEE1CFDE8BE7D87C7C0B510450BAD6BC0906<\/td>\nUpdate.js \u2014 JS\/TrojanDropper.FrostyNeighbor<\/td>\n<\/tr>\n
SHA-1<\/td>\n43E30BE82D82B24A6496F6943ECB6877E83F88AB<\/td>\nViberPC.dll \u2014 Win32\/CobaltStrike.Beacon<\/td>\n<\/tr>\n
SHA-1<\/td>\n4F2C1856325372B9B7769D00141DBC1A23BDDD14<\/td>\n53_7.03.2026_R.pdf \u2014 PDF\/TrojanDownloader.FrostyNeighbor<\/td>\n<\/tr>\n
SHA-1<\/td>\nD89E5524E49199B1C3B66C524E7A63C3F0A0C199<\/td>\nCertificate.pdf \u2014 PDF\/TrojanDownloader.FrostyNeighbor<\/td>\n<\/tr>\n
SHA-1<\/td>\n7E537D8E91668580A482BD77A5A4CABA26D6BDAC<\/td>\ncertificate.js \u2014 JS\/TrojanDownloader.FrostyNeighbor<\/td>\n<\/tr>\n
SHA-1<\/td>\nFA6882672AD3654800987613310D7C3FBADE027E<\/td>\ncertificate.js \u2014 JS\/TrojanDownloader.FrostyNeighbor<\/td>\n<\/tr>\n
SHA-1<\/td>\n3FA7D1B13542F1A9EB054111F9B69C250AF68643<\/td>\n\u0421\u0435\u0442\u0438\u0444\u0456\u043a\u0430\u0442CAF.rar \u2014 JS\/TrojanDropper.FrostyNeighbor<\/em>\n<\/td>\n<\/tr>\n
SHA-1<\/td>\n4E52C92709A918383E90534052AAA257ACE2780C<\/td>\n\u0421\u0435\u0442\u0438\u0444\u0456\u043a\u0430\u0442CAF.js \u2014 JS\/TrojanDropper.FrostyNeighbor<\/em>\n<\/td>\n<\/tr>\n
SHA-1<\/td>\n6FDED427A16D5314BA3E1EB9AFD120DC84449769<\/td>\nEdgeTaskMachine.js \u2014 JS\/TrojanDropper.FrostyNeighbor<\/td>\n<\/tr>\n
SHA-1<\/td>\n27FA11F6A1D653779974B6FB54DE4AF47F211232<\/td>\nEdgeSystemConfig.dll \u2014 Win32\/CobaltStrike.Beacon<\/td>\n<\/tr>\n
Domain<\/td>\nattachment-storage-asset-static.needbinding[.]icu<\/td>\nC&C server \u2014 PicassoLoader delivery<\/td>\n<\/tr>\n
Domain<\/td>\nbook-happy.needbinding[.]icu<\/td>\nC&C server \u2014 scheduled task template and fingerprint collection<\/td>\n<\/tr>\n
Domain<\/td>\nnama-belakang.nebao[.]icu<\/td>\nC&C server \u2014 Cobalt Strike beacon C&C<\/td>\n<\/tr>\n
Domain<\/td>\neasiestnewsfromourpointofview.algsat[.]icu<\/td>\nC&C infrastructure<\/td>\n<\/tr>\n
Domain<\/td>\nmickeymousegamesdealer.al[.]icu<\/td>\nC&C infrastructure<\/td>\n<\/tr>\n
Domain<\/td>\nexavegas[.]icu<\/td>\nC&C infrastructure<\/td>\n<\/tr>\n
Domain<\/td>\nhinesafar.sardk[.]icu<\/td>\nC&C infrastructure<\/td>\n<\/tr>\n
Domain<\/td>\nshinesafar.sardk[.]icu<\/td>\nC&C infrastructure<\/td>\n<\/tr>\n
Domain<\/td>\nbest-seller.lavanille[.]buzz<\/td>\nC&C infrastructure<\/td>\n<\/tr>\n
URL<\/td>\nhttps:\/\/book-happy.needbinding[.]icu\/wp-content\/uploads\/2023\/10\/1GreenAM.jpg<\/td>\nScheduled task template delivery URL<\/td>\n<\/tr>\n
URL<\/td>\nhttps:\/\/book-happy.needbinding[.]icu\/employment\/documents-and-resources<\/td>\nPicassoLoader fingerprint POST endpoint<\/td>\n<\/tr>\n
URL<\/td>\nhttps:\/\/nama-belakang.nebao[.]icu\/statistics\/discover.txt<\/td>\nCobalt Strike beacon C&C endpoint<\/td>\n<\/tr>\n
Filename<\/td>\n53_7.03.2026_R.rar<\/td>\nFirst-stage RAR archive lure<\/td>\n<\/tr>\n
Filename<\/td>\n53_7.03.2026_R.js<\/td>\nFirst-stage JavaScript dropper<\/td>\n<\/tr>\n
Filename<\/td>\n53_7.03.2026_R.pdf<\/td>\nDecoy PDF lure document<\/td>\n<\/tr>\n
Filename<\/td>\nUpdate.js<\/td>\nPicassoLoader second-stage downloader<\/td>\n<\/tr>\n
Filename<\/td>\nWinUpdate.reg<\/td>\nRegistry file dropped by first-stage script<\/td>\n<\/tr>\n
Filename<\/td>\nViberPC.exe<\/td>\nRenamed copy of rundll32.exe<\/td>\n<\/tr>\n
Filename<\/td>\nViberPC.dll<\/td>\nCobalt Strike beacon payload<\/td>\n<\/tr>\n
Filename<\/td>\nViberPC.reg<\/td>\nRegistry file for Cobalt Strike persistence<\/td>\n<\/tr>\n
Filename<\/td>\nViberPC.lnk<\/td>\nShortcut file for Cobalt Strike execution<\/td>\n<\/tr>\n
Filename<\/td>\nEdgeTaskMachine.js<\/td>\nAdditional FrostyNeighbor dropper<\/td>\n<\/tr>\n
Filename<\/td>\nEdgeSystemConfig.dll<\/td>\nAdditional Cobalt Strike beacon<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em>[.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post Hackers Abuse Scheduled Tasks to Maintain Persistence in FrostyNeighbor Attacks<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Hackers Abuse Scheduled Tasks to Maintain Persistence in FrostyNeighbor Attacks A state-aligned hacking group known as FrostyNeighbor has resurfaced with a fresh wave of cyberattacks targeting government organizations in Ukraine, using a carefully designed infection chain that is harder than ever to detect. The group, active since at least 2016, has a long history of […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-12892","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/12892"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=12892"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/12892\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=12892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=12892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=12892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}