ESET: Belarus-Aligned Hackers Make First Destructive Attack
ESET’s APT report for April-September 2026 says a Belarus-aligned group hit a Ukrainian manufacturer and Iran-aligned groups returned after a lull.
Featured photo: an office tower bearing ESET’s name in San Diego (file photo). Photo: Nehrams2020, Wikimedia Commons, CC BY-SA 3.0.
Belarus-aligned hackers carried out the first destructive cyberattack by such a group that ESET has documented in the European theater, hitting a manufacturing company in Ukraine, the security firm said in its APT Activity Report for April through September 2026, published Oct. 28.
ESET named the group FrostyNeighbor. The report says Belarus-aligned groups are acting as cyber proxies or force multipliers for Russia and increasingly reflect Russia’s intelligence priorities in Ukraine. ESET said its findings are based mostly on its own telemetry.
Russia and Belarus
ESET said Russia-aligned activity kept supporting Moscow’s war aims, targeting governments, the defense sector and military entities in Europe, with far more targets in Ukraine. It said operations by Gamaredon declined significantly, possibly because of Ukrainian attacks on Crimea, where the group is suspected to operate, or a restructuring.
The firm also reported a campaign in Ukraine that exploited MDaemon mail servers and deployed two backdoors it calls HELLAGE and HELLTAG, and Android spyware it named PrincessSpy, pushed by a group impersonating Ukrainian entities.
Iran and the Middle East
Iran-aligned activity rose after a quieter period that ESET linked to internet restrictions imposed by the Iranian regime. FilthyFeline, a subgroup of OilRig, and MuddyWater resumed operations, mostly against Israeli entities, with a smaller number of U.S. companies affected, ESET said.
It also reported activity by Arid Viper, which it describes as Hamas-affiliated, against what appears to be the Palestinian Authority’s foreign ministry or a related body.
China and North Korea
China-aligned groups focused on intelligence collection against governments, ESET said, and ran campaigns in Southeast Asia and Oceania that appear to support Chinese law enforcement against organized crime, including attacks on hotels in Palau. Another cluster targeted Taiwan’s semiconductor industry.
North Korea-aligned groups increasingly targeted Ukraine, which ESET linked to North Korea’s growing role in Russia’s war. It said Lazarus resumed targeting the drone sector with recruitment-themed lures.
What it means
Analysis: ESET’s assessment that Belarus, not North Korea, is the clearest cyber proxy for Russia in Ukraine is a useful corrective to assumptions about Pyongyang. A first destructive attack by a Belarus-aligned group is a threshold worth tracking, though it rests on a single vendor’s telemetry.
Sources
Related coverage
- Information War Nov 7, 2026: Unproven MQ-9 Claims
- Censys Finds Hundreds of Exposed ARTEX AI Attack Consoles
- Google Dismantles XCPE Botnet in 1.3 Million TV Boxes
