A Belarus-aligned hacking group has carried out a destructive cyberattack against a Ukrainian manufacturer that plays an important role in the country's transportation sector, according to ESET. It is the first destructive attack by a Belarus-aligned actor that ESET has documented in the European theater, a role that until now ESET had seen filled only by Russia-aligned groups.
The finding is the sharpest item in ESET's APT Activity Report covering April to September 2026, which ESET says is based mostly on its own telemetry.
Belarus is working Moscow's target list
ESET attributes the attack to FrostyNeighbor, the group also tracked as Ghostwriter and UNC1151. More broadly, ESET says Belarus-aligned actors grew more active and assertive over the period, with operations in some areas increasingly reflecting Russia's intelligence priorities in Ukraine. Despite expectations that North Korea's growing military cooperation with Russia would pull its hackers into the war, ESET's telemetry points more clearly to Belarus-aligned groups acting as cyber proxies or force multipliers for Moscow.
Russia-aligned activity kept targeting European governments, defence and military entities, with a substantially higher number of targets in Ukraine. Gamaredon, normally among the busiest groups, saw a significant decline, which ESET suspects could relate to Ukrainian attacks on Crimea, where the group is suspected to operate, or to a restructuring. It still updated its PteroBox file stealer and adopted new tools. ESET also identified an extensive campaign exploiting MDaemon mail servers in Ukraine that deployed two backdoors, HELLAGE and HELLTAG.
China chases scam compounds, North Korea eyes drones
China-aligned groups mainly collected intelligence on government targets. In Southeast Asia and Oceania, ESET saw campaigns that appear to support Chinese law enforcement against organized crime, including attacks on hotels in Palau and SlippyNunchucks deploying its DarkVigil toolset in Sri Lanka against Chinese-speaking individuals tied to fraud schemes. Another cluster targeted Taiwan's semiconductor industry.
North Korea-aligned actors stuck to technology and cryptocurrency firms and software developers, with Ukraine increasingly prominent among their targets. Lazarus resumed targeting the drone sector with recruitment-themed lures, and DeceptiveDevelopment moved from fake job interviews to software supply-chain compromises, using harvested developer credentials to inject code into source repositories. Iran-aligned groups returned after a quieter period, with FilthyFeline, an OilRig subgroup, and MuddyWater directing most activity at entities in Israel.
AI speeds hackers up but has not changed the game
ESET found several APT groups using AI and large language models, chiefly to accelerate malware development and build decoy websites, sometimes in a style resembling vibe coding. In one case, Russia-aligned UAC-0099 planted a decoy request for nuclear weapon instructions in a script comment, apparently to trip the guardrails of LLM-based security analysis and stop it inspecting the malicious code that followed. Even so, ESET says AI has not substantially reshaped the APT landscape over the past six months, and its telemetry still shows hands-on-keyboard operators.
Treat FrostyNeighbor intrusions as potentially destructive
For organizations in Ukraine's manufacturing and transport supply chains, the practical change is that a FrostyNeighbor intrusion can no longer be assumed to be espionage only. Offline backups, tested restores and network segmentation now belong in the response plan for this actor. MDaemon administrators in the region should confirm their servers are fully patched and check them for unfamiliar implants; ESET's public summary does not name the exploited flaw.
The question has long been which of Russia's partners would join its cyber war in earnest. ESET's telemetry for this half-year suggests Belarus already has, and no longer only to spy.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.