FrostyNeighbor Campaign Uses Scheduled Tasks To Maintain Stealthy Access

Deep within the digital shadows, state-sponsored actors continue to refine their cyber espionage arsenals.

FrostyNeighbor a Belarusian-aligned threat group also tracked as Ghostwriter, UNC1151, and Storm-0257 is back with a highly sophisticated new playbook.

Known for relentless hacking and disinformation campaigns targeting Eastern Europe, the group has recently unleashed a stealthy attack chain designed to slip past modern defenses quietly.

By weaponizing seemingly benign PDF documents and exploiting Windows scheduled tasks, FrostyNeighbor is actively deploying dangerous Cobalt Strike beacons onto compromised networks.

Active since at least 2016, this persistent collective has historically targeted government, military, and private sector entities in Ukraine, Poland, and Lithuania.

In previous iterations, FrostyNeighbor relied on legitimate services like Slack for payload delivery and Canarytokens to meticulously track its victims.

While their past operations relied on exploiting known vulnerabilities such as the WinRAR flaw (CVE-2023-38831) and Roundcube XSS bugs, their newest campaign, discovered in March 2026, shows their tactics are evolving to prioritize ultimate stealth.

Scheduled Tasks Enable Persistence

The latest operation begins with a highly targeted spear-phishing email that carries a malicious lure.

Victims receive a blurry PDF file named “53_7.03.2026_R.pdf,” which impersonates the Ukrainian telecommunications company Ukrtelecom.

The document features a deceptive download button that redirects the target to an attacker-controlled delivery server.

To evade researchers, FrostyNeighbor employs strict geographic filtering at this stage.

If the click originates from an unexpected location outside of the target zone, the server delivers a harmless decoy document regarding electronic communication regulations.

However, if the victim’s IP address maps to Ukraine, the server delivers a malicious RAR archive instead.

According to welivesecurity research, this archive contains a deobfuscated JavaScript dropper that simultaneously displays the decoy PDF while silently launching a JavaScript version of PicassoLoader in the background.

This signature downloader drives the core of the attack through several intricate phases:

• The script reaches out to a command-and-control server to download a scheduled task template disguised as a harmless image file named “1GreenAM.jpg.”
• Despite the file extension, the server actually delivers a text-based XML configuration file that establishes persistence on the host machine.
• PicassoLoader aggressively fingerprints the victim’s computer, collecting the username, operating system version, and running processes, then sends this information back to the attackers.
• Operators manually review this telemetry data to determine if the target is valuable before deploying the final payload.

Indicators of Compromise

Continuous monitoring of FrostyNeighbor’s evolving infrastructure is essential for detecting future breaches.

Security teams should immediately review their networks for the following files associated with the March 2026 campaign.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.