ESET: Belarus-aligned GhostWriter carried out first destructive cyberattack

ESET's Q2–Q3 2026 APT report documented the first destructive cyberattack by a Belarus-aligned group against a European entity: GhostWriter hit a Ukrainian manufacturer in late May 2026. The group, previously focused on espionage and phishing, is now operating closer to Russia's war priorities.

• GhostWriter struck a Ukrainian manufacturer in late May 2026
• The group had focused on espionage and phishing since 2016
• Phishing used geofencing: non-Ukrainian IPs got harmless PDFs
• Gamaredon's activity declined, possibly due to strikes on Crimea