Belarusian APT FrostyNeighbor Launches First Destructive Cyberattack in Ukraine
A Belarus-aligned threat group, FrostyNeighbor, has executed its first documented destructive cyberattack in Ukraine, signaling increased support for Russian strategic objectives and raising regional security concerns.
Researchers have identified the first destructive cyberattack attributed to a Belarus-aligned threat actor targeting a critical manufacturing company in Ukraine. The incident, detailed in ESET's latest APT Activity Report, suggests a growing alignment between Belarusian cyber operations and Russian strategic goals in the ongoing conflict.
The threat group, known as FrostyNeighbor and also tracked as UNC1151, has historically engaged in disinformation and cyber espionage. However, this recent operation marks a significant escalation, moving beyond espionage to destructive actions. The group deployed a combination of tools including Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper, utilizing Group Policy to execute the attack against the Ukrainian firm, which plays a vital role in the country's transportation sector.
While Belarusian and Russian threat actors have shared targeting interests in the past, particularly concerning the drone sector, ESET's telemetry indicates a more direct proxy or force multiplier role for Belarusian groups. The report notes an "increased and more assertive activity from Belarus-aligned threat actors, with their operations increasingly reflecting Russia’s intelligence priorities in Ukraine in some areas."
Damien Schaeffer, a senior malware researcher at ESET, pointed to the number of attacks, the victimology aligning with Russian strategic priorities, and the sophisticated nature of these operations as strong indicators of closer operational integration with Russia. This trend of increased aggressiveness was first observed by ESET at the beginning of 2024.
This development occurs as North Korea also expands its military cooperation with Russia, suggesting a broader trend of cyber activities aligning with Russia's war efforts. Russia has notably intensified its cyberattacks against European nations supporting Ukraine, including those on NATO's eastern flank and critical logistics hubs.
Experts like Alexander Leslie from Recorded Future acknowledge FrostyNeighbor's sustained operations and evolving techniques but differ on the extent of operational integration with Russia. Recorded Future recommends tracking Belarus-linked clusters and correlating their activities with Russian campaigns while maintaining attribution distinctions. Regardless of the precise level of command and control, defenders are advised to treat Belarus-linked actors as significant threats.
CERT Polska reported in June 2026 that UNC1151 was one of the most active APT groups they monitor, with new phishing domains appearing almost daily. Organizations in sectors critical to Ukraine's defense and support, such as government, transportation, and defense, should anticipate increased encounters with campaigns whose objectives align closely with Moscow's broader strategic interests.
The implications of this escalating cyber activity extend beyond Ukraine, posing potential risks to the broader European security landscape as state-aligned actors increase their offensive cyber capabilities in support of geopolitical objectives.