ESET: Belarus-linked FrostyNeighbor wipes Ukrainian transport manufacturer
Original title: As Russia's Cyberwar Evolves, Belarus Steps Forward
UNC1151 used Chisel, UltraVNC, Cobalt Strike and a VBScript wiper delivered through Group Policy.
ESET’s APT Activity Report for Q2 and Q3 2026 describes what it calls the first destructive cyberattack it has documented by a Belarus-aligned actor in Europe. FrostyNeighbor, also tracked as UNC1151, hit an unnamed Ukrainian manufacturer that ESET says is important to the country’s transportation sector. The group deployed Chisel, UltraVNC, Cobalt Strike and a VBScript wiper through Group Policy. The report presents the incident as a possible escalation of support for Russian objectives.
Unconfirmed: Closer alignment with Russian objectives is ESET’s interpretation, and the company is unnamed.
- ESET says this is its first documented Belarus-aligned destructive attack in Europe.
- The victim is an unnamed manufacturer tied to Ukraine’s transportation sector.
- Named tools are Chisel, UltraVNC, Cobalt Strike and a VBScript wiper.
- The wiper was deployed through Group Policy.
- FrostyNeighbor is also tracked as UNC1151.
Impact: Destructive wiper attack on a Ukrainian manufacturer
- Threat actors
- FrostyNeighborUNC1151
- Malware
- ChiselUltraVNCCobalt Strike
- Organizations
- ESET
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 3ef22544cbb516d50d8fedafef6855a8 | -delta-industrial-plcs#recipe=similar-items&sourcecontentid=3ef22544cbb516d50d8fedafef6855a8) Trio of Critical Bugs Spotted in Delta Industrial PLCs by |
| md5 | 519f866bd9cb0808a2c4934672007466 | ensors-silent-tracking#recipe=similar-items&sourcecontentid=519f866bd9cb0808a2c4934672007466) Vehicle Tire Pressure Sensors Enable Silent Tracking by J |
| md5 | 6709b09566c154b383fa194e8d34ff5f | mpatible-work-securely#recipe=similar-items&sourcecontentid=6709b09566c154b383fa194e8d34ff5f) AI in OT Sparks Cascade of Complex Challenges by Arielle |
| md5 | a7eb29aeaac9d69fb51ea172d29e5391 | king-systems-tampering#recipe=similar-items&sourcecontentid=a7eb29aeaac9d69fb51ea172d29e5391) Critical Railway Braking Systems Open to Tampering by Nat |
From the original article
7 min read at darkreading.com
The "FrostyNeighbor" advanced persistent threat (APT) launched a destructive attack in Ukraine and is raising concerns about deeper alignment with Russian cyber objectives.
By Alexander Culafi · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.