ESET Says a Belarus-Aligned Group Deployed a Wiper at a Ukrainian Firm

A Belarus-aligned hacking group deployed destructive wiper malware against a Ukrainian manufacturer in late May, according to the ESET APT Activity Report for April to September 2026. ESET says it is the first destructive cyberattack by a Belarus-aligned actor that it has documented in Europe, and that until now the groups with a record of destructive operations in Ukraine had been Russia-aligned.

The finding matters to defenders less as a single incident than as a change in who they need to plan for. ESET attributes the attack to FrostyNeighbor, also tracked as UNC1151, a group long associated with espionage and phishing rather than destruction. Its release on GlobeNewswire says Belarus-aligned activity “increasingly converges with Russia’s war priorities”, while Iran-aligned groups have returned after a quieter period.

A wiper pushed through Group Policy

According to the full ESET APT Activity Report, FrostyNeighbor (also known as PUSHCHA, Storm-0257 and TA445) moved through the victim’s network with the tunnelling tool Chisel, the remote-access tool UltraVNC and Cobalt Strike, before deploying “a VBScript wiper via Group Policy”. ESET says the company “plays an important role in the country’s transportation sector”.

ESET is careful about motive. It says the wiper may simply have been used to erase traces of an espionage operation, but that the targeting “still appears closer to Moscow’s strategic priorities than to Minsk’s”. Belarus-aligned groups, it says, are growing more aggressive, and their targets increasingly echo Russia’s intelligence needs in Ukraine. The attack “sets a precedent”, ESET adds, which “opens the possibility of other Belarus-aligned APT groups conducting wiper attacks in the near future”.

The report’s own chart shows how these groups usually get in: 87.4% of initial access by Belarus-aligned groups came through spearphishing attachments, and 12.6% through exploiting public-facing applications.

This is not ESET’s first recent look at wipers in Ukraine. Last week TSN reported its finding that two Russian groups worked together on a 2025 wiper attack on a Ukrainian grain firm.

Iran-aligned groups return, and other shifts

ESET says activity aligned with the Middle East rose, mainly because established Iran-aligned groups came back. FilthyFeline, an OilRig subgroup, and MuddyWater resumed operations, mostly against Israeli organisations across several sectors, with a smaller number of US companies also affected. ESET links the earlier lull most likely to internet restrictions imposed by the Iranian authorities. TSN recently covered another Iran-linked operation, a command server that Semperis says was hidden on US soil.

On North Korea, ESET says Ukraine has become more prominent among targets alongside South Korea, and that Lazarus resumed targeting the drone sector with recruitment-themed lures. A separate North Korea-aligned group, DeceptiveDevelopment, moved from fake job interviews into software supply chains: its malware harvests “Git credentials, SSH keys, and access tokens” and the group injects malicious code into victims’ repositories, “often rewriting the commit history to cover their tracks”.

China-aligned groups targeted Taiwanese semiconductor organisations, consistent with long-running industrial espionage priorities, ESET says; TSN has explained why Taiwan’s chip capacity matters. ESET also reports that Gamaredon, normally one of the busiest Russia-aligned groups, saw a significant decline in activity, and describes a campaign in Ukraine exploiting MDaemon mail servers without any user interaction. MDaemon shipped an outdated ClamAV component vulnerable to CVE-2025-8088, which ESET says was fixed in MDaemon 26.0.4 on 25 August 2026.

ESET finds AI speeding up attackers, not replacing them

ESET found several APT groups using large language models, mainly to speed up malware development and build decoy websites. Jean-Ian Boutin, ESET’s director of threat research, says in the release that some of this “resembled vibe coding”. In one case, the Russia-aligned UAC-0099 planted a decoy request for nuclear-weapon instructions in a script comment, apparently to trip the safety guardrails of AI-based security tools.

Even so, ESET says it has “not noticed AI substantially reshaping the APT landscape over the past six months”. Its telemetry still shows hands-on-keyboard activity, and it compares APT groups’ use of AI to that of mainstream software developers. That matches Microsoft’s finding this week that North Korean hackers use AI to scale familiar attacks rather than invent new ones.

Defenders should plan for Belarus-aligned destruction now

The practical lesson of the ESET APT Activity Report is that a group’s history is a weak guide to its next move. FrostyNeighbor was known for phishing and espionage, and ESET now documents it reaching for a wiper. For organisations in Ukraine, and for those in Europe working in transport, defence or government with links to Ukraine, the safer assumption is that an intrusion by a Belarus-aligned group could end in destruction, not just data theft.

The techniques ESET lists are familiar ones, which is useful. Malicious Group Policy changes, unexpected tunnelling tools such as Chisel and stray remote-access software are all things a monitored domain should flag. With most Belarus-aligned initial access coming through email attachments, attachment filtering and staff reporting remain the first line. Tested, offline backups are what decides whether a wiper causes a bad day or a lasting outage.

Attribution caution cuts both ways. ESET says its visibility does not allow a firm judgement on Belarusian cooperation with Russia. Alexander Leslie of Recorded Future told Dark Reading that Belarus-linked clusters should be tracked with attribution distinctions preserved, adding: “Defenders do not need proof of Russian tasking to prioritize an actor already targeting them.” That is the right test for security teams: who is in the network matters more than who gave the order. The MDaemon case also shows how an old third-party library can leave a mail server open; vendors’ patch notes are worth checking for bundled components, not just headline fixes.

For UK readers the direct exposure is mostly through suppliers and partners in Ukraine and the region, but the lessons on Group Policy abuse and patching bundled components apply to any Windows estate. Ukraine has already ordered every state body to form a cyber security team, and Symantec recently described APT28 hacking defence and police targets in two NATO countries.

The next marker is whether ESET or another vendor documents a second Belarus-aligned wiper, which ESET itself says is now possible. More cases are tracked in TSN’s Ransomware & Cyber Attacks hub.

Sources

• ESET (WeLiveSecurity): ESET APT Activity Report Q2 2026–Q3 2026, 28 October 2026
• ESET: ESET APT Activity Report Q2 2026–Q3 2026 (full PDF)
• ESET via GlobeNewswire: ESET Research APT Report release, 28 October 2026
• Dark Reading: As Russia’s Cyberwar Evolves, Belarus Steps Forward, 30 October 2026

Related stories

• ESET Links 2025 Wiper Attack on Ukrainian Grain Firm to Two Russian Groups
• Microsoft Says North Korean Hackers Use AI to Scale Familiar Attacks