Researchers have identified the first destructive cyberattack orchestrated by a Belarusian-aligned actor targeting a critical Ukrainian infrastructure, indicating Belarus may be intensifying its backing for Russian objectives This article explores destructive cyberattack belarus. . This includes using spear phishing and malware.
The organization's report highlights that researchers "have documented the first destructive cyberattack by a Belarus-aligned threat actor in the European theater." Specifically, FrostyNeighbor utilized Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper via Group Policy against a Ukrainian manufacturing company that plays a significant role in the country's transportation sector.
"We observed increased and more assertive activity from Belarus-aligned threat actors, with their operations increasingly reflecting Russia’s intelligence priorities in Ukraine in some areas." ## FrostyNeighbor APT Attacks Its Neighbors Damien Schaeffer, senior malware researcher at ESET, says that the strongest evidence for an increasing operational closeness with Russia is the number of attacks and the victimology that appears closer to and aligned with Russia's strategic priorities than Belarus's own, as well as a sophistication behind these attacks, "which seems relatively high to Belarus's potential interests alone." He says ESET first observed this trend of increasing aggressiveness at the beginning of 2024.
As Leslie explains, CERT Polska identified UNC1151 as one of the most active APT groups it monitors in June 2026, noting that the group observed new phishing domains almost daily in the preceding weeks.
