Фото: Clint Patterson, unsplash.coom
The Belarus-linked hacking group FrostyNeighbor carried out a cyberattack in late May 2026 against a Ukrainian manufacturing company important to the country’s transport sector. This is the first documented case of a destructive cyberattack by a Belarus-linked group, according to an report published by cybersecurity company ESET covering April–September 2026.
The report’s authors note a change in the behaviour of Belarus-linked groups in recent months. Their operations are becoming more aggressive, and their targets reflect Russia’s intelligence priorities.
A clear example of this shift was the attack on a Ukrainian company carried out in late May 2026 by FrostyNeighbor, also known as UNC1151, PUSHCHA, Storm-0257 and TA445. The operation involved the use of Chisel, UltraVNC and Cobalt Strike tools, followed by the deployment of a malicious script designed to destroy data. The script was deployed through Windows Group Policy.
“To the best of our knowledge, this marks the very first documented instance of a Belarus-aligned threat actor conducting a destructive cyberattack. The targeted company seems to play a significant role in Ukraine’s transportation sector, and thus could prove relatively important to the country’s war effort,” the report states.
ESET has not established the exact motives behind the attack but notes that the choice of target aligns more closely with Russia’s strategic priorities than with Belarus’s. Researchers suggest that the group may have been acting on behalf of Russian intelligence or carrying out operational tasks linked to it.
The report notes that several other espionage operations conducted by Belarus-linked groups have also targeted organisations whose activities reflect Russia’s specific needs and objectives in the context of the war. Experts point to an unprecedented convergence between Belarusian and Russian intelligence services.
“While it is not uncommon for Belarus-aligned groups to attack organizations that are of broad interest to their Russian ally, the degree of operational convergence is very much unprecedented. This aligns with other recent public reports, which suggest that Belarusian intelligence agencies are gradually inching toward proxy status with respect to Russia’s security apparatus,” the report states.
According to ESET, cooperation between Russian and Belarusian intelligence services in cyberattacks is likely to intensify. This may take the form of carrying out tasks on behalf of the other side, using shared tools and infrastructure, or engaging in direct operational cooperation.