GhostWriter linked to first Belarus data wipe at Ukrainian firm
Original title: Risky Bulletin: Belarusian state hackers get on the data-wiping train
ESET ties FrostyNeighbor to the wipe and says Belarus-aligned operators increasingly mirror Russian priorities in Ukraine.
According to ESET’s Q2–Q3 APT report, Belarus-linked FrostyNeighbor, also known as GhostWriter, wiped data at a Ukrainian manufacturer with a role in transportation. ESET says Belarus-aligned groups are acting more like proxies or force multipliers for Russia. The same Risky Business bulletin also recaps separate claimed breaches and outages at US agencies, crypto firms, and services in New Zealand and Belgium, with several figures still unconfirmed.
Unconfirmed: Attribution and the Russia-proxy hypothesis are ESET’s assessment; several other breach figures in the bulletin are unconfirmed or changing.
- Researcher Alexis Rapin calls Belarus the sixth country publicly tied to data wipers.
- ESET says AI has not substantially reshaped APT activity over six months.
- The bulletin also covers claimed incidents at DHS, the FEC, Binance, and others.
- Binance loss figures were still changing when the bulletin was recorded.
Impact: Destructive wipe of a Ukrainian manufacturer’s data
- ATT&CK
- T1485 Data Destruction
- Threat actors
- GhostWriterFrostyNeighborDepartment of Peace
- Malware
- Zawoo
- Organizations
- ESET
From the original article
14 min read at news.risky.biz
In other news: Hacker leaks data on 41k DHS employees; Binance hacked for billions; PHP bugs exploited to hack Palo Alto Networks firewalls.
By Catalin Cimpanu · news.risky.biz
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.