Summary
ESET's APT Activity Report for Q2–Q3 2026, published October 28, documents what it calls the first destructive attack by a Belarus-aligned threat actor in Europe. The group, FrostyNeighbor (also tracked as UNC1151 and widely known as Ghostwriter), struck a Ukrainian manufacturing company that plays an important role in the country's transportation sector.
Attack Details
- Tooling: the intrusion used Chisel (tunneling), UltraVNC, Cobalt Strike, and a VBScript wiper distributed via Group Policy.
- Timing: one source places the attack in late May 2026; coverage does not give a precise date.
- Intent unclear: researchers could not determine whether the wiping was meant to cause destruction or to cover up espionage.
- Earlier activity: from March 2026 the group ran spear-phishing campaigns against Ukrainian military, defense and government bodies, which were espionage-focused.
Why It Matters
Until now, actors with a track record of destructive operations in Ukraine have been Russia-aligned. ESET says its telemetry points to Belarus-aligned groups acting as cyber proxies or force multipliers for Russia, and Dark Reading reports the attack is raising concern about deeper alignment between Belarusian operators and Russian cyber objectives.
Distributing a wiper through Group Policy is a notable choice: it requires domain-level privileges, meaning the attackers had already achieved domain compromise before destruction.
Recommendations
- Monitor GPO creation and modification, especially new scheduled tasks or startup scripts pushed domain-wide.
- Restrict and audit Domain Admin and Group Policy editing rights; alert on changes outside change windows.
- Hunt for Chisel, UltraVNC and Cobalt Strike indicators, particularly on servers that should not run remote-control tools.
- Maintain offline, immutable backups and test domain-controller recovery.
- Harden email defenses against spear-phishing targeting defense, government and critical-manufacturing staff.