Belarus-Linked Hackers Move From Spying to Destruction, Mirroring Russia's Priorities in Ukraine

Security firm ESET says hacking groups linked to Belarus are increasingly aligning their operations with Russia's goals in Ukraine. Researchers described an "unprecedented operational convergence" between Russian and Belarusian campaigns over the past few months, with Belarus-aligned actors becoming more active and more assertive. Historically, these groups focused on espionage and influence operations serving Minsk's own interests.

The most significant development came in late May, when a group known as GhostWriter attacked a Ukrainian manufacturing company believed to play an important role in the country's transportation sector. GhostWriter is linked to Belarusian intelligence and has previously targeted Ukraine, Poland and other countries in the region. The attackers used data-wiping malware, which can erase information from compromised systems and disrupt operations. ESET said this was the first destructive attack by a Belarus-aligned group that its researchers had documented in Europe. It could not determine whether the aim was to cause damage or to cover the tracks of an espionage operation.

ESET warned that the attack "sets a precedent" and that other Belarus-aligned state groups could carry out similar wiper attacks in the near future. Researchers also identified several other Belarus-linked espionage operations targeting organisations of particular interest to Russia in connection with the war.