Researchers have spotted the first destructive cyberattack by a Belarus-aligned threat actor against a critical target in Ukraine, suggesting Belarus may be upping its support for Russian national objectives — carrying implications for much of Europe.
ESET this week published its APT Activity Report for Q2 and Q3 2026. The report highlights a range of state-sponsored activity across Europe, Asia, and the Middle East, but one of the most significant assertions involves Belarus, an Eastern European country that has been close allies with Russia in the latter’s invasion of Ukraine.
Historically, Belarusian cyber operations have been tracked separately from those attributed directly to Russian intelligence services, though researchers have long observed overlap in targeting and strategic interests. The Belarusan state-affiliated group FrostyNeighbor — also tracked as UNC1151 — has been known for disinformation and cyber espionage, the latter conducted through various means such as spear phishing and malware.
While the Eastern European country has also set its sights on Ukrainian and Polish targets in phishing attacks to further its own and possibly Russia’s goals, ESET identified a recent escalation in these activities. Mainly, ESET’s report notes that its researchers “identified the first destructive cyberattack by a Belarus-aligned threat actor that we have documented in the European theater.”
Specifically, FrostyNeighbor deployed Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper via Group Policy against a manufacturing company in Ukraine that ESET said “plays an important role in the country’s transportation sector,” which is notable because destructive operations up until this point have been explicitly Russia-aligned.
“While some of their targeting interests overlap, notably around the drone sector, our telemetry more clearly points to Belarus-aligned groups acting as cyberproxies or force multipliers for Russia,” the report read. “We observed increased and more assertive activity from Belarus-aligned threat actors, with their operations increasingly reflecting Russia’s intelligence priorities in Ukraine in some areas.”
FrostyNeighbor APT Attacks Its Neighbors
Damien Schaeffer, senior malware researcher at ESET, says that the strongest evidence for an increasing operational closeness with Russia is the number of attacks and the victimology that appears closer to and aligned with Russia’s strategic priorities than Belarus’s own, as well as a sophistication behind these attacks, “which seems relatively high to Belarus’s potential interests alone.” He says ESET first observed this trend of increasing aggressiveness at the beginning of 2024.
This comes as North Korea expands its own military cooperation with Russia in the latter’s war on Ukraine, which ESET added could mean cyber activity will continue to align as well.
Russia’s war on Ukraine stretches far beyond Ukraine, especially in the realm of cyber operations. Russia has grown bolder in cyberattacks particularly against European countries that support Ukraine militarily or politically, are on NATO’s eastern flank, and support critical logistics hubs for aid flowing into Ukraine.
This, to varying degrees, has included Poland, Estonia, Latvia, Lithuania, Sweden, Czech Republic, and Germany, among others. In other words, if Russian allies are growing bolder in their cyberactivities explicitly supporting Russia, that carries consequences for all of Europe.
Continue to Treat Belarus as Its Own Entity
Alexander Leslie, a national security expert at Recorded Future, tells Dark Reading that its evidence shows FrostyNeighbor as an actor executing sustained operations and evolving its techniques, though not necessarily an overall increase in operational scale nor shared operational command.
Recorded Future’s recommendation is to explicitly track Belarus-linked clusters and correlate their infrastructure, tools, and targeting with Russian threat campaigns “while preserving attribution distinctions.”
“Threat models should cover credential theft, persistent access, and the use of compromised accounts to reach additional people. Intelligence collection should include malicious login infrastructure, email exploitation, personal-account targeting, and abuse of trusted contacts, which are the access routes documented in these campaigns,” Leslie says. “Defenders do not need proof of Russian tasking to prioritize an actor already targeting them.”
While researchers differ on whether Belarusian activity represents deeper operational integration with Russia, they appear to agree that defenders should not dismiss Belarus-linked actors as secondary threats. As Leslie explains, CERT Polska in June 2026 identified UNC1151 as one of the most active APT groups it monitors, “observing new phishing domains almost daily in the preceding weeks.”
Organizations in sectors tied to government, transportation, and defense that show support for Ukraine may increasingly encounter campaigns whose objectives align closely with Moscow’s broader strategic interests.
