Threats · 5h ago
ESET says GhostWriter, a Belarus-linked group, used data-wiping malware in a late-May attack on a Ukrainian manufacturer believed important to transportation—the first destructive cyberattack in Europe by a Belarus-aligned group that ESET has documented. ESET also reports unprecedented operational convergence in recent months, with Belarus-linked activity increasingly reflecting Russian intelligence priorities in Ukraine.
Wiping malware can erase information from compromised systems and disrupt their operations. ESET could not determine whether the attackers meant to cause damage or erase evidence of espionage, so the attack’s purpose remains unclear even as its destructive potential is documented.
If your organization supports Ukrainian manufacturing or transportation, this incident shows that a Belarus-linked intrusion can threaten industrial operations as well as gather intelligence. As activity aligns more closely with Russian priorities, the actor’s national ties alone are a weaker guide to what an operation may do.
1 source covering this story
The Record from Recorded Future
Belarusian hackers increasingly acting as proxies for Russia amid war in Ukraine
Belarus-linked hackers are increasingly aligning their cyber operations with Russia's interests in Ukraine, researchers said Wednesday.
Part of the PlainSec briefing for 2026-10-28