ESET Says Belarus-Linked Hackers Deployed Wiper at Ukrainian Transport Supplier

ESET says a Belarus-linked hacking group deployed a data-destroying script inside an unnamed Ukrainian manufacturer important to the country’s transport sector, marking the first destructive operation by such an actor that the company has documented.

The late-May intrusion began with tools built for access and control: Chisel, UltraVNC and Cobalt Strike. ESET’s report says FrostyNeighbor then pushed a VBScript wiper across the victim’s network through Group Policy, the Windows mechanism administrators use to impose settings across many machines.

ESET did not name the manufacturer, quantify the damage or publish victim confirmation. Its researchers said the wiper may have been used to erase traces left by an espionage operation. They called the reasons for the attack murky and stopped short of claiming that Minsk or Moscow ordered it.

The group is also tracked as UNC1151, Ghostwriter, PUSHCHA, Storm-0257 and TA445. In May, ESET documented a separate campaign against Ukrainian government organizations that used malicious PDF links, a JavaScript loader and Cobalt Strike after the operators screened potential victims.

Other researchers have independently tied the actor to Belarusian espionage, though not to this specific destructive attack. Mandiant assessed with high confidence in 2021 that UNC1151 was linked to the Belarusian government, while saying it had no direct evidence of Russian contributions. SentinelLABS later documented Ghostwriter campaigns against Ukrainian military and government targets and Belarusian opposition activists.

ESET argues that Belarus-aligned operations are increasingly echoing Russian intelligence priorities and may be moving toward a proxy role. Its report also says visibility is too limited for a firm judgment. Reform.news published a separate account of the finding but did not provide independent victim forensics or a response from Belarus.

The public evidence therefore establishes a named research finding, a documented tool chain and a longer espionage history. It does not establish who authorized the wiper, how much data was destroyed or whether the operation affected Ukraine’s transport system beyond the unnamed supplier.