ESET links Belarusian group to destructive attack in Ukraine

Researchers say the first destructive cyberattack attributed to a Belarus-aligned threat actor targeting a critical Ukrainian site marks a notable shift in the region’s cyber operations. ESET’s APT Activity Report for Q2 and Q3 2026 notes that FrostyNeighbor (UNC1151) has escalated its activity, deploying Chisel, UltraVNC, Cobalt Strike and a VBScript-based wiper via Group Policy against a Ukrainian manufacturing company described as playing an important role in the country’s transportation sector.

The report frames the operation as destructive and emphasises that the Belarus-aligned group is increasingly acting as a cyberproxy or force multiplier for Russia, with targeting and techniques that align with Moscow’s priorities in Ukraine.

Damien Schaeffer, senior malware researcher at ESET, points to the rising frequency and victimology of these attacks as evidence of closer alignment with Russian strategic interests, while noting that the overall operational scale has not necessarily increased. Recorded Future’s Alexander Leslie adds that defenders should explicitly track Belarus-linked clusters and correlate infrastructure, tools and targeting with Russian campaigns, even if attribution to Russia remains distinguishable.

CERT Polska had previously identified UNC1151 as one of the most active clusters in June 2026, observing new phishing domains almost daily in the preceding weeks. The piece also highlights that, alongside Ukraine, Belarusian activity has shown interest in Polish targets and in the drone sector, with potential implications for other European states that support Ukraine.

The report underlines that cyber operations linked to Russian objectives are not confined to Ukraine, extending to several European victims and critical logistics hubs.