Belarusian hackers increasingly acting as proxies for Russia amid war in Ukraine
Belarus-linked hackers are increasingly aligning their cyber operations with Russia's interests in Ukraine, with cybersecurity researchers documenting an unprecedented operational convergence between the two countries' hacking campaigns.
Researchers have observed an "unprecedented operational convergence" between Russian and Belarusian hacking campaigns over the past few months. The most significant development came in late May, when a Belarus-linked hacking group launched a destructive cyberattack against a Ukrainian manufacturing company believed to play an important role in the country's transportation sector.
The attack was attributed to GhostWriter, a threat actor linked to Belarusian intelligence services that has previously conducted cyberespionage and influence operations against Ukraine, Poland and other countries in the region. ESET said it was the first destructive cyberattack by a Belarus-aligned group that its researchers had documented in Europe, marking an escalation from the group's previously observed activities.
Escalation in cyber warfare
The hackers used data-wiping malware, which can erase information from compromised systems and disrupt their operations. ESET could not establish whether the malware was intended to cause damage or simply cover the tracks of an espionage operation.
Regardless of the hackers' motivation, the attack 'sets a precedent' and raises the possibility that other Belarus-aligned state groups could carry out wiper attacks in the near future.
Although Belarus has not deployed its own troops to fight in Ukraine, it has supported Russia's invasion by allowing Moscow to use its territory to launch military operations and missile strikes. Belarusian hackers have historically focused on espionage and influence operations serving Minsk's own interests, but the latest destructive attack appeared more closely aligned with Russia's wartime priorities.
Growing proxy cooperation
Researchers suggest Belarusian hacking groups are increasingly serving as proxies or "force multipliers" for Russia. ESET warned that the trend could lead to closer cooperation between Russian and Belarusian hackers, including the sharing of tools and infrastructure, the outsourcing of targeting operations or even direct collaboration on cyberattacks.
In addition to Belarus-linked groups, ESET found that North Korean hackers have stepped up their cyberattacks against Ukrainian targets amid growing military cooperation between Pyongyang and Moscow. The researchers found some overlap between Moscow's and Pyongyang's intelligence interests, particularly regarding Ukraine's rapidly developing drone industry.
North Korean hackers have nevertheless expanded their targeting of Ukrainian organizations, potentially seeking intelligence and technical expertise that could benefit Pyongyang's own military capabilities. Other cybersecurity researchers have also reported growing North Korean interest in Ukrainian targets.
Related
