Key facts
- ESET’s Q2–Q3 2026 APT report identifies GhostWriter, a Belarus-aligned group, as the first to conduct a destructive cyberattack against a European target: a Ukrainian manufacturing firm in late May 2026.
- GhostWriter used a multi-stage phishing campaign against Ukrainian government organizations, deploying a JavaScript-based PicassoLoader downloader and Cobalt Strike beacon to gain full network access.
- Iran’s MuddyWater group deployed a new backdoor, Dindoor, against US banks, airports, and defense software companies using the Deno JavaScript runtime to evade detection.
- North Korea’s Lazarus Group resumed targeting European drone manufacturers, including firms producing UAVs deployed in Ukraine, via fake job recruitment lures (Operation DreamJob).
ESET’s Q2–Q3 2026 APT report names GhostWriter as the group behind the first destructive cyber attack on a European target, which struck a Ukrainian manufacturing company in late May 2026.
GhostWriter dates back to at least 2016 and has targeted Ukrainian state bodies, the armed forces and Belarusian opposition figures. ESET lists the group’s aliases including UNC1151, UAC-0057, FrostyNeighbor and Storm-0257. ESET says Belarus-aligned groups now serve as cyber proxies for Russia, reflecting Moscow’s intelligence goals in Ukraine while building destructive capacity.
A March 2026 phishing campaign by GhostWriter targeted Ukrainian government organizations, using a JavaScript-based PicassoLoader downloader and Cobalt Strike beacon to obtain full network access. “The payload is only delivered after server-side victim validation,” said Damien Schaeffer. The operation used geofenced delivery to stay hidden beyond Ukraine’s borders and struck entities including Ukrtelecom and Prometheus.
Iran’s MuddyWater group deployed the Dindoor backdoor against American banks, airports and defense software firms in March 2026, relying on Deno, a JavaScript runtime, to avoid detection. Victims included a US banking institution, a major US airport, a Canadian nonprofit and an Israeli defense software company tied to a US business. The attackers also used Rclone to move data to Wasabi cloud storage and deployed a Python backdoor called Fakeset, with MuddyWater attribution based on digital certificate overlaps with earlier tools such as Stagecomp and Darkcomp.
UAC-0099, a Russian-aligned actor, used GuardBreaker in June and September 2026 to defeat AI-powered security scanners, inserting nuclear weapon-related text into malware comments to trip safety guardrails and prevent code analysis. ESET says APT groups mainly use AI to speed up existing work such as building malware and making decoy websites, rather than to create entirely new attack methods.
Belarusian group Cyber Partisans, also known as Partisan Zmiy, spent nearly two years inside a Russian healthcare organization starting in 2024, using the Vasilek backdoor disguised as VMware software. The group dropped the Pryanik wiper and the Evlx tool to wipe Windows event logs, combining espionage with destructive ability and relying on Telegram for command and control and data removal.
North Korea’s Lazarus Group resumed its campaign against European drone manufacturers, including makers of UAVs (unmanned aerial vehicles) sent to Ukraine, in April 2026. The group used fake job offers under Operation DreamJob to deliver the ScoringMathTea remote access trojan (RAT).
Join the discussion