Belarusian hackers increasingly acting as proxies for Russia amid war in Ukraine

Belarus-linked hackers are increasingly aligning their cyber operations with Russia's interests in Ukraine, the cybersecurity firm ESET said Wednesday.

Researchers have observed an "unprecedented operational convergence" between Russian and Belarusian hacking campaigns over the past few months.

"We observed increased and more assertive activity from Belarus-aligned threat actors, with their operations increasingly reflecting Russia's intelligence priorities in Ukraine in some areas," researchers said.

The most significant development came in late May, when a Belarus-linked hacking group launched a destructive cyberattack against a Ukrainian manufacturing company believed to play an important role in the country's transportation sector.

The attack was attributed to GhostWriter, a threat actor linked to Belarusian intelligence services that has previously conducted cyberespionage and influence operations against Ukraine, Poland and other countries in the region.

ESET said it was the first destructive cyberattack by a Belarus-aligned group that its researchers had documented in Europe, marking an escalation from the group's previously observed activities.

The hackers used data-wiping malware, which can erase information from compromised systems and disrupt their operations. ESET could not establish whether the malware was intended to cause damage or simply cover the tracks of an espionage operation.

Regardless of the hackers' motivation, the attack "sets a precedent" and raises the possibility that other Belarus-aligned state groups could carry out wiper attacks in the near future, researchers said.

Although Belarus has not deployed its own troops to fight in Ukraine, it has supported Russia's invasion by allowing Moscow to use its territory to launch military operations and missile strikes. 

Belarusian hackers have historically focused on espionage and influence operations serving Minsk's own interests, but the latest destructive attack appeared more closely aligned with Russia's wartime priorities, according to ESET.

The researchers also identified several other Belarus-linked espionage operations targeting organizations of particular interest to Russia in connection with the war.

Researchers suggest that Belarusian hacking groups are increasingly serving as proxies or "force multipliers" for Russia. ESET warned that the trend could lead to closer cooperation between Russian and Belarusian hackers, including the sharing of tools and infrastructure, the outsourcing of targeting operations or even direct collaboration on cyberattacks.

North Korea's growing role

In addition to Belarus-linked groups, ESET found that North Korean hackers have stepped up their cyberattacks against Ukrainian targets amid growing military cooperation between Pyongyang and Moscow.

The researchers found some overlap between Moscow's and Pyongyang's intelligence interests, particularly regarding Ukraine's rapidly developing drone industry. However, researchers said the evidence of North Korean cyber operations directly supporting Russia's war effort was less definitive than the growing alignment they observed among Belarusian groups.

North Korean hackers have nevertheless expanded their targeting of Ukrainian organizations, potentially seeking intelligence and technical expertise that could benefit Pyongyang's own military capabilities.

Other cybersecurity researchers have also reported growing North Korean interest in Ukrainian targets.

Earlier in October, South Korean cybersecurity firm Genians said the North Korean hacking group Kimsuky had targeted Ukrainian experts in diplomacy, security and international policy.

In May 2025, cybersecurity firm Proofpoint reported that North Korean-linked hackers had sent malicious emails to Ukrainian government agencies, potentially seeking intelligence about threats facing North Korean troops deployed alongside Russian forces.