ESET Reports First Documented Destructive Cyberattack by Belarus-Aligned Actor in Europe
Summary
ESET says FrostyNeighbor (UNC1151) used Chisel, UltraVNC, Cobalt Strike and a VBScript wiper via Group Policy against a Ukrainian manufacturing company tied to transportation, marking its first documented destructive attack by a Belarus-aligned actor in Europe.
Key points
- ESET's Q2 and Q3 2026 activity report describes the attack as the first destructive cyberattack by a Belarus-aligned actor that ESET has documented in Europe.
- ESET says FrostyNeighbor, also tracked as UNC1151, deployed Chisel, UltraVNC, Cobalt Strike and a VBScript wiper via Group Policy against a Ukrainian manufacturing company important to the transportation sector.
- ESET observed increased and more assertive activity by Belarus-aligned actors, with some operations reflecting Russian intelligence priorities in Ukraine.
- Recorded Future recommends tracking Belarus-linked clusters distinctly while correlating their infrastructure, tools and targeting with Russian campaigns; its expert cautioned that evidence does not necessarily show shared operational command.
- CERT Polska identified UNC1151 among the most active APT groups it monitors in June 2026 and observed new phishing domains almost daily in the preceding weeks.
Article Details
- Event Type
- ESET reported the first destructive cyberattack it has documented in the European theater by a Belarus-aligned threat actor.
- Impact
- ESET says FrostyNeighbor deployed a wiper via Group Policy against a Ukrainian manufacturing company important to the country's transportation sector. The reported escalation suggests Belarus-aligned cyber activity may increasingly support Russian strategic objectives, with potential consequences for other European countries; researchers differ on the extent of operational integration with Russia.
People
Alexander LeslieRecorded Future national security expert who discussed FrostyNeighbor's sustained operations and recommended tracking Belarus-linked clusters while preserving attribution distinctions.Damien SchaefferESET senior malware researcher who discussed evidence of increasingly aggressive Belarus-aligned operations and their alignment with Russian strategic priorities.
Threat Actors
FrostyNeighborBelarus-aligned group that ESET says deployed a wiper against a Ukrainian manufacturing company. The article also attributes disinformation, cyber espionage, and phishing activity to the group.UNC1151Name used to track FrostyNeighbor; ESET identifies UNC1151 as one of the most active APT groups monitored by CERT Polska in June 2026.
Tools
ChiselSpecifically, FrostyNeighbor deployed Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper via Group Policy against a manufacturing company in Ukraine that ESET said "plays an important role in the country'sCobalt StrikeSpecifically, FrostyNeighbor deployed Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper via Group Policy against a manufacturing company in Ukraine that ESET said "plays an important role in the country'sUltraVNCSpecifically, FrostyNeighbor deployed Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper via Group Policy against a manufacturing company in Ukraine that ESET said "plays an important role in the country's
Countries
BelarusResearchers have spotted the first destructive cyberattack by a Belarus-aligned threat actor against a critical target in Ukraine, suggesting Belarus may be upping its support for Russian national objectives — carryingCzech RepublicThis, to varying degrees, has included Poland, Estonia, Latvia, Lithuania, Sweden, Czech Republic, and Germany, among others. In other words, if Russian allies are growing bolder in their cyberactivities explicitlyEstoniaThis, to varying degrees, has included Poland, Estonia, Latvia, Lithuania, Sweden, Czech Republic, and Germany, among others. In other words, if Russian allies are growing bolder in their cyberactivities explicitlyGermanyThis, to varying degrees, has included Poland, Estonia, Latvia, Lithuania, Sweden, Czech Republic, and Germany, among others. In other words, if Russian allies are growing bolder in their cyberactivities explicitlyLatviaThis, to varying degrees, has included Poland, Estonia, Latvia, Lithuania, Sweden, Czech Republic, and Germany, among others. In other words, if Russian allies are growing bolder in their cyberactivities explicitlyLithuaniaThis, to varying degrees, has included Poland, Estonia, Latvia, Lithuania, Sweden, Czech Republic, and Germany, among others. In other words, if Russian allies are growing bolder in their cyberactivities explicitlyNorth KoreaThis comes as North Korea expands its own military cooperation with Russia in the latter's war on Ukraine, which ESET added could mean cyber activity will continue to align as well.PolandThis, to varying degrees, has included Poland, Estonia, Latvia, Lithuania, Sweden, Czech Republic, and Germany, among others. In other words, if Russian allies are growing bolder in their cyberactivities explicitlyRussiamost significant assertions involves Belarus, an Eastern European country that has been close allies with Russia in the latter's invasion of Ukraine.SwedenThis, to varying degrees, has included Poland, Estonia, Latvia, Lithuania, Sweden, Czech Republic, and Germany, among others. In other words, if Russian allies are growing bolder in their cyberactivities explicitlyUkrainespotted the first destructive cyberattack by a Belarus-aligned threat actor against a critical target in Ukraine, suggesting Belarus may be upping its support for Russian national objectives — carrying implications for
Industries
DefenseOrganizations in sectors tied to government, transportation, and defense that show support for Ukraine may increasingly encounter campaigns whose objectives align closely with Moscow's broader strategic interests.GovernmentOrganizations in sectors tied to government, transportation, and defense that show support for Ukraine may increasingly encounter campaigns whose objectives align closely with Moscow's broader strategic interests.Manufacturingdeployed Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper via Group Policy against a manufacturing company in Ukraine that ESET said "plays an important role in the country's transportation sector,"Transportationagainst a manufacturing company in Ukraine that ESET said "plays an important role in the country's transportation sector," which is notable because destructive operations up until this point have been explicitly