MediumII Cyber Warfare & Critical Infrastructure28 October 2026, Wednesday
Belarus-aligned group mounts its first destructive cyberattack in Europe
The Belarus-aligned FrostyNeighbor group carried out a destructive attack on a Ukrainian manufacturer serving the transport sector, according to ESET's APT report covering April–September 2026, published on 28 October. ESET recorded it as the first destructive attack in Europe attributed to a Belarus-aligned actor.
ESET's report of 28 October tracked Russia-aligned activity against government, defence and military targets in Europe over the six-month period, with markedly more targets in Ukraine. Until now, the report says, destructive operations in Ukraine had been the work of Russia-aligned groups alone. TechTimes identified the same group as GhostWriter and UNC1151, dated the attack to late May and said the group has been active since at least 2016. Neither the date of the attack nor the wiper used appears in ESET's own text; these details could not be verified.
According to TechTimes, the group has been running geofenced phishing against Ukrainian state bodies since March 2026. Visitors from non-Ukrainian IP addresses receive a harmless PDF, while Ukrainian IPs receive a loader that fingerprints the system every 10 minutes. The same group also targets industrial, healthcare, pharmacy and logistics companies in Poland and Lithuania. ESET wrote that Lazarus has again targeted the drone sector with recruitment-themed lures. North Korea's choice of targets was linked to drones used in Ukraine.
For insurers, the threshold is that the attack is both state-linked and destructive. TechTimes recalled that the 2017 NotPetya attack caused an estimated 10 billion dollars in damage worldwide. State-backed destructive attacks are where war and state-action exclusions in cyber policies get tested. The Belarus-aligned group's move to sabotage risks widening the reach of those exclusions for logistics and healthcare companies in Poland and Lithuania.
Talay assessment
Bottom line
The Belarus-aligned group's shift from espionage to sabotage adds to the number of state-linked actors in Europe with destructive capability. This time the target was in Ukraine, but the same group's hunt for access to logistics and healthcare firms in Poland and Lithuania suggests the risk could carry into the EU. Because the attack's date and tooling have not been independently verified, the scale of the threat remains uncertain.
Likely effects
- EU eastern flank infrastructureNegative1–6 months
Industrial, healthcare and logistics targets in Poland and Lithuania are on the same group's list; destructive capability raises incident response and backup costs in both countries.
- Cyber insuranceNegative1–6 months
State-linked destructive attacks are where war exclusions get tested; NotPetya's estimated 10 billion dollars in damage gives insurers grounds to tighten cover terms on the eastern flank.
- Ukrainian transport supplyNegativeWeeks
Targeting a manufacturer serving the transport sector points to an intent to disrupt, by cyber means, the industrial supply that feeds wartime logistics.
Possibilities, ranked
- 1Contained to Ukraine55%
The group keeps its destructive tools for Ukraine and confines itself to espionage in Poland and Lithuania.
Watch: New wiper incidents attributed to the Belarus-aligned group in CERT-UA and CERT Polska advisories
- 2Sabotage spills into the EU30%
A destructive incident at a logistics or healthcare company in Poland or Lithuania is attributed to the Belarus-aligned group.
Watch: A formal cyber attribution to Belarus by the Polish or Lithuanian government
- 3A one-off test15%
No new destructive incident appears in ESET's next period, and the May attack remains an exception.
Watch: ESET's report covering October 2026–March 2027
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Destructive actors▼ +1 state-linked