ESET: Belarus-linked FrostyNeighbor wipes Ukrainian transport manufacturer
UNC1151 used Chisel, UltraVNC, Cobalt Strike and a VBScript wiper delivered through Group Policy.
74
Country
Ukraine
- Mentions · 7d21
- Mentions · 30d94
- All mentions188
- First seenAug 12, 2026
- Last mentioned18h ago
Timeline
188 articles · newest firstGhostWriter linked to first Belarus data wipe at Ukrainian firm
ESET ties FrostyNeighbor to the wipe and says Belarus-aligned operators increasingly mirror Russian priorities in Ukraine.
64
Hive and Nefilim affiliate sentenced to 70 months in prison
Artem Stryzhak pleaded guilty in December 2025; the FBI still offers up to $11 million for co-conspirator Volodymyr Tymoshchuk.
54
Nefilim and Hive affiliate sentenced to 70 months in US
Ukrainian Artem Stryzhak was arrested in Spain in June 2024, extradited in April 2025, and allegedly hit about seven Hive victims.
58
ESET: GhostWriter wiper hit a Ukrainian manufacturer
ESET calls the late-May attack the first destructive Belarus-aligned operation it has documented in Europe and says intent is unclear.
74
Ukrainian Hive and Nefilim affiliate sentenced to 70 months
Artem Stryzhak deployed Nefilim in 2021 and Hive against seven organizations, including healthcare and law firms.
58
Nefilim and Hive affiliate Artem Stryzhak sentenced to nearly six years
The State Department is offering up to $11 million for co-conspirator Volodymyr Tymoshchuk; Hive hit about 1,500 victims worldwide.
62
Ukrainian Nefilim and Hive affiliate sentenced to 70 months
Artem Stryzhak, 36, pleaded guilty in December 2025 after extradition from Spain; co-conspirator Tymoshchuk remains sought.
62
ESET maps APT activity from April through September 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
72
Nefilim and Hive ransomware affiliate sentenced to 70 months
Artem Stryzhak pleaded guilty after attacks on hospitals and large firms; an alleged accomplice remains at large.
58
Nefilim and Hive affiliate sentenced to 70 months
Artem Stryzhak pleaded guilty in December 2025; the FBI says the groups caused more than $100 million in losses.
58
Nefilim and Hive affiliate Artem Stryzhak sentenced to 70 months
He pleaded guilty after extradition from Spain for attacks from 2018 through 2021; prosecutors still seek co-conspirator Volodymyr Tymoshchuk.
46
Cloudflare Radar records 49 Internet disruptions in Q3 2026
Exam shutdowns in Iraq and power failures, including large drops in Honduras, Cuba, and Sevastopol, led the quarter’s outages.
44
CERT-UA: attackers control Dahua cameras and recorders via Easy4IP
Devices with Easy4IP dial out to Dahua’s cloud and can be opened by serial number without a public IP or open ports.
74
CERT-UA warns Dahua cameras in Ukraine hijacked via P2P and auth flaws
Attackers guess Easy4IP serial numbers and use weak passwords or CVE-2021-33044 and CVE-2021-33045 on outdated firmware.
76
Rapid7 says 71% of tracked exploitation starts within a week
Across 43 newly exploited high- and critical-severity flaws, disclosure-to-exploitation averaged three days.
54
Attackers use public PHP2Shell exploits against university and business sites
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated command execution; fixed PHP builds shipped on October 21.
88
Caseway CEO says expansion is shifting to Taiwan and Europe
The founder says a September 8 US directive halted new American sales while two existing US customers remain.
28
Ukraine says Starlink restored, disputes Musk misuse claim
Nearly two weeks of speed limits disrupted missions; officials say commercial terminals could not fly the alleged strikes.
58
CERT-UA warns hackers are compromising Dahua surveillance cameras
Attackers use Easy4IP serial patterns, weak passwords or outdated firmware to reach cameras even when they sit behind firewalls.
72
Starshield limits on Ukraine fuel European sovereignty debate
Steve Blank writes that a reported personal order by Elon Musk showed allies a US vendor kill switch.
34
Sandworm wiped a Ukrainian logistics firm after UAC-0099 access
ESET says MythicRatatoskr used a Yggdrasil mesh C2, and Sandworm wiped systems with SDelete on September 17, 2025.
73
PHP2Shell exploit attempts try to deploy Potassium Mirai
Sophos says the attempts failed, while SOCRadar found exploit tooling aimed at PHP 8.4.26.
74
FBI raids Texas laptop farms tied to North Korean IT schemes
Operation Lonestar Roundup seized 187 devices, charged 14 people, and affected more than 70 US companies, the FBI says.
62
ICRC tells UN autonomous weapons already amplify wartime harm
Gisel says AI targeting in Gaza and Ukraine speeds lethal decisions and can leave humans out of the loop.
48
UAC-0099 handed Ukraine grain firm access to Sandworm
MythicRatatoskr used Yggdrasil for C2; Sandworm later wiped data with SDelete via Group Policy.
76
Russian satellite Kosmos 2612 closed in on ICEYE-X36
LeoLabs says the low-Earth-orbit approach fits proximity operations, but intent and the closest distance remain disputed.
8
Sandworm wiped a Ukrainian grain firm after UAC-0099 access
ESET says a July 2025 phishing foothold led to a September wipe, using a new backdoor that talked over Yggdrasil.
68
OpenAI expands ChatGPT Ads to 26 more countries, now in 89
Ads remain limited to Free and Go; Plus, Pro, and Enterprise stay ad-free, and OpenAI says it does not sell conversation data.
48
Ukraine evacuates a wounded soldier on a heavy hexacopter drone
The Heavy Shot AYUDAG 6 flight lasted 1 hour 14 minutes and covered nearly 39 miles, Gurzuf Defence said.
8
APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
78
Ukraine evacuates a wounded soldier by heavy drone
An 80kg infantryman was flown about 18km from the Kharkiv front on a modified Heavy Shot drone.
3
VK services disrupted after drone strike on data center near St. Petersburg
Downdetector logged about 6,600 VK complaints Sunday; NetBlocks said related connectivity fell to 56% of normal.
42
Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia
Moscow police detained suspected DataSuckers hackers over the Dodo Pizza breach affecting hundreds of millions of orders.
52
Moscow detains suspected DataSuckers hackers linked to breaches in Ukraine and Russia
Moscow placed a suspected DataSuckers member under house arrest over the Dodo Pizza customer-data breach.
62
Malware evasion made easier with AI — but behavior still gives it away
ReversingLabs says Midnight Blizzard’s AI-rebuilt backdoor kept the same detectable behavior across five variants.
56
Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
Midnight Blizzard-linked operators used Claude to rebuild ChocoShell and CornFlake malware against Ukrainian and European targets.
78
Risky Bulletin: Russia arrests DataSuckers hacking group
Russia arrested DataSuckers members accused of extortion hacks against Dodo Pizza, ATB Market, and Tez Tour.
64
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Qilin and Settra are exploiting PAN-OS GlobalProtect flaw CVE-2026-0257, alongside new RATs and a DNS wallet drainer.
86
Data Centers Are War Targets Now
Ukrainian drones struck Russian Yandex and Sberbank data centers, disrupting everyday digital services across Russia.
73
Related CVEs
by mentions- CVE-2021-33044100%9.8Authentication Bypass in Dahua IP Camera Firmware
- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2021-33045100%9.8Authentication Bypass in Dahua IP Cameras, NVRs and Video Intercoms
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
- CVE-2021-36260100%9.8Unauthenticated Command Injection in Hikvision Device Web Server
- CVE-2026-2158999%9.3Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- CVE-2026-8877911%8.7Unauthenticated denial of service in NetScaler ADC and Gateway
- CVE-2026-4815<1%8.7A SQL Injection vulnerability has been found in Support Board v3.7.7
- CVE-2023-20598<1%7.8An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over…
- CVE-2026-54569<1%9.8SENAITE.CORE: The SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing…
Appears with
- Microsoftvendor · 29
- CERT-UAorganization · 24
- FBIorganization · 18
- UAC-0099threat actor · 17
- ESETorganization · 17
- MatchBoilmalware · 15
- Anthropicvendor · 15
- Anthropicorganization · 15
- Claudeai model · 13
- ShinyHuntersthreat actor · 12
- Sandwormthreat actor · 11
- Midnight Blizzardthreat actor · 11
- Microsoftorganization · 11
- Yandexorganization · 10
- MatchWokmalware · 10
- Windowsproduct · 10
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.