A destructive attack on a Ukrainian manufacturer signals a change in the activity ESET has documented from Belarus-aligned hackers. In findings covered by The Record on October 28, the security firm attributed the late-May attack to GhostWriter and assessed that Belarus-linked operations increasingly follow Russia’s wartime intelligence interests.
The manufacturer is believed to have an important role in Ukraine’s transportation sector. According to ESET, the attack was the first destructive operation in Europe that its researchers had documented from a Belarus-aligned group. GhostWriter has links to Belarusian intelligence services and a history of espionage and influence campaigns targeting Ukraine, Poland and other countries in the region.
The use of a wiper introduces a destructive capability into that history: the malware can delete information from compromised systems and interrupt their operation. Its purpose in this attack remains uncertain, however. ESET could not determine whether the attackers sought to inflict damage or erase evidence of an espionage operation.
That uncertainty limits conclusions about motive, but ESET placed the incident within a broader shift in targeting. Belarusian groups have traditionally pursued intelligence and influence objectives serving Minsk. Researchers now see more activity reflecting Russian priorities in Ukraine, including other espionage operations against organizations of particular wartime interest to Moscow.
ESET suggested that Belarusian groups increasingly supplement Russia’s cyber capabilities as proxies or “force multipliers.” The researchers warned that closer alignment could eventually involve exchanging tools and infrastructure, handing off targeting work or conducting attacks together. These were possible developments identified by ESET, rather than confirmed features of the manufacturer attack.
The firm also observed more North Korean attacks against Ukrainian organizations as military cooperation between Pyongyang and Moscow grows. Ukraine’s drone industry was one area where researchers identified overlapping intelligence interests. But ESET drew a distinction between the two countries’ activity: evidence that North Korean cyber operations directly assist Russia’s war effort was less conclusive than the alignment seen among Belarusian groups. North Korean targeting could also seek knowledge and technical expertise for Pyongyang’s own military.
