Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa, the Asia Pacific, Europe, and Latin America.
The "FrostyNeighbor" advanced persistent threat (APT) launched a destructive attack in Ukraine and is raising concerns about deeper alignment with Russian cyber objectives.
October 30, 2026
Researchers have spotted the first destructive cyberattack by a Belarus-aligned threat actor against a critical target in Ukraine, suggesting Belarus may be upping its support for Russian national objectives — carrying implications for much of Europe.
ESET this week published its APT Activity Report for Q2 and Q3 2026 . The report highlights a range of state-sponsored activity across Europe, Asia, and the Middle East, but one of the most significant assertions involves Belarus, an Eastern European country that has been close allies with Russia in the latter's invasion of Ukraine.
Historically, Belarusian cyber operations have been tracked separately from those attributed directly to Russian intelligence services, though researchers have long observed overlap in targeting and strategic interests. The Belarusan state-affiliated group FrostyNeighbor — also tracked as UNC1151 — has been known for disinformation and cyber espionage, the latter conducted through various means such as spear phishing and malware.
Related: Russia's Hybrid Cyber-Physical War in Europe Heats Up
While the Eastern European country has also set its sights on Ukrainian and Polish targets in phishing attacks to further its own and possibly Russia's goals, ESET identified a recent escalation in these activities. Mainly, ESET's report notes that its researchers "identified the first destructive cyberattack by a Belarus-aligned threat actor that we have documented in the European theater."
Specifically, FrostyNeighbor deployed Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper via Group Policy against a manufacturing company in Ukraine that ESET said "plays an important role in the country's transportation sector," which is notable because destructive operations up until this point have been explicitly Russia-aligned.
"While some of their targeting interests overlap, notably around the drone sector, our telemetry more clearly points to Belarus-aligned groups acting as cyberproxies or force multipliers for Russia," the report read. "We observed increased and more assertive activity from Belarus-aligned threat actors, with their operations increasingly reflecting Russia’s intelligence priorities in Ukraine in some areas."
Damien Schaeffer, senior malware researcher at ESET, says that the strongest evidence for an increasing operational closeness with Russia is the number of attacks and the victimology that appears closer to and aligned with Russia's strategic priorities than Belarus's own, as well as a sophistication behind these attacks, "which seems relatively high to Belarus's potential interests alone." He says ESET first observed this trend of increasing aggressiveness at the beginning of 2024.
This comes as North Korea expands its own military cooperation with Russia in the latter's war on Ukraine, which ESET added could mean cyber activity will continue to align as well.
Russia's war on Ukraine stretches far beyond Ukraine , especially in the realm of cyber operations. Russia has grown bolder in cyberattacks particularly against European countries that support Ukraine militarily or politically, are on NATO's eastern flank, and support critical logistics hubs for aid flowing into Ukraine.
This, to varying degrees, has included Poland , Estonia, Latvia, Lithuania, Sweden, Czech Republic, and Germany, among others. In other words, if Russian allies are growing bolder in their cyberactivities explicitly supporting Russia, that carries consequences for all of Europe.
Alexander Leslie, a national security expert at Recorded Future, tells Dark Reading that its evidence shows FrostyNeighbor as an actor executing sustained operations and evolving its techniques, though not necessarily an overall increase in operational scale nor shared operational command.
Recorded Future's recommendation is to explicitly track Belarus-linked clusters and correlate their infrastructure, tools, and targeting with Russian threat campaigns "while preserving attribution distinctions."
"Threat models should cover credential theft, persistent access, and the use of compromised accounts to reach additional people. Intelligence collection should include malicious login infrastructure, email exploitation, personal-account targeting, and abuse of trusted contacts, which are the access routes documented in these campaigns," Leslie says. "Defenders do not need proof of Russian tasking to prioritize an actor already targeting them."
While researchers differ on whether Belarusian activity represents deeper operational integration with Russia, they appear to agree that defenders should not dismiss Belarus-linked actors as secondary threats. As Leslie explains, CERT Polska in June 2026 identified UNC1151 as one of the most active APT groups it monitors , "observing new phishing domains almost daily in the preceding weeks."
Organizations in sectors tied to government, transportation, and defense that show support for Ukraine may increasingly encounter campaigns whose objectives align closely with Moscow's broader strategic interests.
Read more about:
Alexander Culafi
Senior News Writer, Dark Reading
Alex is an award-winning writer, journalist, and podcast host based in Boston. After cutting his teeth writing for independent gaming publications as a teenager, he graduated from Emerson College in 2016 with a Bachelor of Science in journalism. He has previously been published on VentureFizz, Search Security, Nintendo World Report, and elsewhere.
At Dark Reading, he covers a variety of cybersecurity topics, including the cybercrime ecosystem, open source security, and the intersection between AI and threat actors. In his spare time, Alex hosts the weekly Nintendo podcast, "Talk Nintendo Podcast," and works on personal writing projects, including two previously self-published science fiction novels.
He has received numerous awards, including TechTarget's Writer of the Year in 2022 as well as more than 10 Azbee awards for his reporting between 2022 and today.