The first wiper attack

ESET's report on activity in the second and third quarters of 2026, published on 28 October 2026 and covered on 29 October, documents the first destructive cyberattack by a Belarus-aligned group against a European target. The attacker is GhostWriter, also tracked as UNC1151, UAC-0057, FrostyNeighbor and Storm-0257, a Belarus-aligned group linked to Belarusian intelligence services and active since at least 2016.

The attack hit a Ukrainian manufacturing company with an important role in the country's transportation sector in late May 2026, using data-wiping malware. The news event is ESET's October disclosure, not a fresh attack this week.

Why ESET says it matters

ESET could not establish whether the wiper was meant to cause damage or to cover the tracks of an espionage operation, but said it sets a precedent for further Belarus-aligned wiper attacks. ESET researcher Alexis Rapin noted Belarus becomes the sixth country publicly documented deploying wiper malware, and that Belarusian groups are increasingly acting as proxies or force multipliers for Russia in Ukraine.

The report covers April to September 2026 and describes an unprecedented operational convergence between Russian and Belarusian hacking campaigns over the past few months. GhostWriter was previously known mainly for espionage and influence operations, which makes the shift to destructive malware a notable change in behaviour.

Sources: Risky Bulletin