ESET's report for Q2 and Q3 2026 describes a wiper attack on a Ukrainian manufacturer. A wiper is malware that destroys data. ESET said it is the first destructive attack by a Belarus-aligned actor that it has documented in Europe. Dark Reading reported that the group is FrostyNeighbor, also tracked as UNC1151. It said ESET called the victim important to Ukraine's transport sector. Dark Reading listed the tools as Chisel, UltraVNC, Cobalt Strike and a VBScript wiper pushed out through Group Policy.
ESET said Belarus-aligned groups increasingly act as proxies, or force multipliers, for Russia. Researcher Damien Schaeffer told Dark Reading that the number of attacks, the victims and the skill level point that way. He said ESET first saw this trend in early 2024. The sources give no date for the attack. They also say nothing about the damage it did.
Dark Reading noted that destructive attacks until now had been explicitly Russia-aligned. It said that if Russia's allies grow bolder, this carries consequences for all of Europe. For teams that run or buy software there, the report shows a second set of state-aligned groups using destructive tools.