Belarus-Linked Hackers Deploy Wiper Malware in First Documented Destructive Attack on Ukraine

In late May 2026, Belarus-aligned threat actors known as FrostyNeighbor deployed a VBScript wiper malware against a Ukrainian manufacturing company in the transportation sector. This represents the first documented destructive cyberattack by a Belarus-aligned group, marking a shift from espionage to destructive operations. The attackers used tools including Chisel, UltraVNC, and Cobalt Strike, delivering the destructive payload via Group Policy. The targeting of a transportation-related company suggests potential wartime operational objectives. Researchers note increasing aggression from Belarus-aligned groups, possibly acting as proxies for Russian intelligence, though direct cooperation is unconfirmed.

• Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial AccessCampaign2026-10-26
• PIVOTPIPE: A New .NET-based Unofficial Beacon PayloadMalware2026-09-16
• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law EnforcementMalware2026-07-09
• The Gentlemen are knocking: сustom backdoors and evolving tacticsMalware2026-06-29