GoKawiilESET: Belarus-aligned group FrostyNeighbor launches first destructive cyberattack in Ukraine
ESET's APT Activity Report for Q2-Q3 2026 documents the first destructive cyberattack attributed to a Belarus-aligned threat actor in the European theater. The group, FrostyNeighbor (also known as UNC1151), used tools including Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper deployed via Group Policy against a Ukrainian manufacturing firm tied to the country's transportation sector.