--- title: As Russia's Cyberwar Evolves, Belarus Steps Forward description: ESET's APT Activity Report for Q2 and Q3 2026 documents the first destructive cyberattack by a Belarus-aligned threat actor in Europe. The group,... canonical: https://daily.dev/posts/as-russia-s-cyberwar-evolves-belarus-steps-forward-fmkkcwnpq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: As Russia's Cyberwar Evolves, Belarus Steps Forward | daily.dev og:description: ESET's APT Activity Report for Q2 and Q3 2026 documents the first destructive cyberattack by a Belarus-aligned threat actor in Europe. The group,... og:url: https://daily.dev/posts/as-russia-s-cyberwar-evolves-belarus-steps-forward-fmkkcwnpq og:image: https://api.daily.dev/og/posts/FmKkCwNpQ.png og:image:alt: As Russia's Cyberwar Evolves, Belarus Steps Forward og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # As Russia's Cyberwar Evolves, Belarus Steps Forward **[Dark Reading](https://daily.dev/sources/dr)** · 4 min read · 0 upvotes · 0 comments ## Summary ESET's APT Activity Report for Q2 and Q3 2026 documents the first destructive cyberattack by a Belarus-aligned threat actor in Europe. The group, FrostyNeighbor (also tracked as UNC1151), hit a Ukrainian manufacturing company important to the country's transportation sector. Attackers deployed Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper delivered via Group Policy. ESET says Belarus-aligned groups increasingly act as cyberproxies for Russia, a trend it first noticed in early 2024. Recorded Future's Alexander Leslie notes CERT Polska found UNC1151 among the most active APT groups it tracks, spotting new phishing domains almost daily. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What tools did the FrostyNeighbor APT group use in its attack on Ukraine? FrostyNeighbor, a Belarus-aligned threat actor also tracked as UNC1151, deployed Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper distributed via Group Policy. The attack targeted a manufacturing company that plays an important role in Ukraine's transportation sector, marking the first destructive cyberattack by a Belarus-aligned group documented in the European theater. _Security teams tracking APT tooling trends can follow threat intelligence coverage like this on daily.dev._ ### Is Belarus acting as a cyber proxy for Russia in the war against Ukraine? ESET's telemetry points to Belarus-aligned groups increasingly acting as cyberproxies or force multipliers for Russia, with operations reflecting Russia's intelligence priorities in Ukraine in some areas. ESET researcher Damien Schaeffer says this trend of increasing aggressiveness and sophistication began at the start of 2024, though Recorded Future cautions the evidence shows sustained, evolving operations rather than proof of shared command. _Anyone assessing nation-state cyber risk can track evolving APT attribution analysis on daily.dev._ ### How active is the UNC1151 threat group against Polish and Ukrainian targets? CERT Polska identified UNC1151, also known as FrostyNeighbor, as one of the most active APT groups it monitors as of June 2026, observing new phishing domains almost daily in the preceding weeks. The group has targeted Ukrainian and Polish organizations through phishing and espionage, in addition to its recent destructive attack. _Defenders prioritizing persistent phishing threats can keep up with APT activity reports on daily.dev._ ## Similar posts on daily.dev - [Russia Pivots Its Cyberthreats Back to the U.S. and the West](https://daily.dev/posts/russia-pivots-its-cyberthreats-back-to-the-u-s-and-the-west-ld5awdhaz) · Security Boulevard · 0 upvotes · 0 comments - [Russian Threat Actor Sednit Resurfaces With Sophisticated Toolkit](https://daily.dev/posts/russian-threat-actor-sednit-resurfaces-with-sophisticated-toolkit-rnewjohnk) · Dark Reading · 0 upvotes · 0 comments - [Chinese spy group caught lurking in Poland, Asia networks](https://daily.dev/posts/chinese-spy-group-caught-lurking-in-poland-asia-networks-9camnlgtt) · The Register · 1 upvotes · 0 comments - [TAG-193’s Regional Espionage Operations](https://daily.dev/posts/tag-193-s-regional-espionage-operations-msjq5somv) · Recorded Future Blog · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/as-russia-s-cyberwar-evolves-belarus-steps-forward-fmkkcwnpq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"As Russia's Cyberwar Evolves, Belarus Steps Forward","url":"https://daily.dev/posts/as-russia-s-cyberwar-evolves-belarus-steps-forward-fmkkcwnpq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/as-russia-s-cyberwar-evolves-belarus-steps-forward-fmkkcwnpq"},"datePublished":"2026-10-30T08:02:46.352Z","dateModified":"2026-10-30T08:04:42.890Z","description":"ESET's APT Activity Report for Q2 and Q3 2026 documents the first destructive cyberattack by a Belarus-aligned threat actor in Europe. The group,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f096f0d58593f838a423e3c55e9d8c80?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f096f0d58593f838a423e3c55e9d8c80?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/as-russia-s-cyberwar-evolves-belarus-steps-forward-fmkkcwnpq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"As Russia's Cyberwar Evolves, Belarus Steps Forward"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/as-russia-s-cyberwar-evolves-belarus-steps-forward-fmkkcwnpq#faq","mainEntity":[{"@type":"Question","name":"What tools did the FrostyNeighbor APT group use in its attack on Ukraine?","acceptedAnswer":{"@type":"Answer","text":"FrostyNeighbor, a Belarus-aligned threat actor also tracked as UNC1151, deployed Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper distributed via Group Policy. The attack targeted a manufacturing company that plays an important role in Ukraine's transportation sector, marking the first destructive cyberattack by a Belarus-aligned group documented in the European theater. Security teams tracking APT tooling trends can follow threat intelligence coverage like this on daily.dev."}},{"@type":"Question","name":"Is Belarus acting as a cyber proxy for Russia in the war against Ukraine?","acceptedAnswer":{"@type":"Answer","text":"ESET's telemetry points to Belarus-aligned groups increasingly acting as cyberproxies or force multipliers for Russia, with operations reflecting Russia's intelligence priorities in Ukraine in some areas. ESET researcher Damien Schaeffer says this trend of increasing aggressiveness and sophistication began at the start of 2024, though Recorded Future cautions the evidence shows sustained, evolving operations rather than proof of shared command. Anyone assessing nation-state cyber risk can track evolving APT attribution analysis on daily.dev."}},{"@type":"Question","name":"How active is the UNC1151 threat group against Polish and Ukrainian targets?","acceptedAnswer":{"@type":"Answer","text":"CERT Polska identified UNC1151, also known as FrostyNeighbor, as one of the most active APT groups it monitors as of June 2026, observing new phishing domains almost daily in the preceding weeks. The group has targeted Ukrainian and Polish organizations through phishing and espionage, in addition to its recent destructive attack. Defenders prioritizing persistent phishing threats can keep up with APT activity reports on daily.dev."}}]} ```