ESET: GhostWriter wiper hit a Ukrainian manufacturer
Original title: Belarusian hackers increasingly acting as proxies for Russia amid war in Ukraine
ESET calls the late-May attack the first destructive Belarus-aligned operation it has documented in Europe and says intent is unclear.
ESET said Wednesday that Belarus-linked hackers are increasingly aligning operations with Russia’s priorities in Ukraine. In late May, GhostWriter, which ESET links to Belarusian intelligence, used data-wiping malware against a Ukrainian manufacturer believed to matter to transportation. ESET could not tell whether the wiper was meant to destroy systems or hide espionage. The firm also describes other Belarus-linked espionage and a less definitive rise in North Korean targeting of Ukraine, including Kimsuky and malicious email reported by other firms.
Unconfirmed: ESET could not establish whether the wiper was meant to cause damage or cover espionage, and North Korean support for Russia’s war is described as less definitive.
- ESET says it saw unprecedented operational convergence over recent months.
- GhostWriter has previously targeted Ukraine, Poland, and other regional countries.
- ESET warns of possible tool, infrastructure, and targeting sharing with Russian hackers.
- Genians said in October that Kimsuky targeted Ukrainian diplomacy and security experts.
- Proofpoint reported May 2025 malicious email to Ukrainian government agencies.
Impact: Data-wiping malware used against a Ukrainian manufacturer
- Threat actors
- GhostWriterKimsuky
- Organizations
- ESETGeniansProofpoint
From the original article
3 min read at therecord.mediaBelarus-linked hackers are increasingly aligning their cyber operations with Russia's interests in Ukraine, researchers said Wednesday.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.