Recent findings indicate a significant shift in Belarus's cyber activities, aligning more closely with Russian national objectives. This development comes after researchers identified the first destructive cyberattack by a Belarus-affiliated group against a critical target in Ukraine. ESET's latest APT Activity Report for Q2 and Q3 2026 highlights a surge in state-sponsored cyber operations across different regions, with particular attention on Belarus's increasing involvement. Historically, Belarusian cyber activities have been distinct from Russian intelligence operations, though overlaps in targets and strategic interests have been observed. The Belarusian group FrostyNeighbor, also known as UNC1151, has been involved in disinformation and cyber espionage, utilizing tactics like spear phishing and malware deployment. The recent escalation involved using tools such as Chisel, UltraVNC, and Cobalt Strike against a Ukrainian manufacturing company crucial to the nation's transportation sector. This marks a departure from previous operations that were primarily Russia-aligned. ESET's research suggests that Belarus-aligned cyber groups are acting as force multipliers for Russia, with their operations increasingly mirroring Russian intelligence priorities. Damien Schaeffer from ESET notes that the sophistication and alignment of these attacks point to a closer operational relationship with Russia. The increasing aggressiveness of Belarusian cyber activities was first noticed in early 2024. This trend coincides with expanded military cooperation between North Korea and Russia, potentially leading to further alignment in cyber activities. Russia's cyber operations extend beyond Ukraine, targeting European countries that support Ukraine politically or militarily. Countries like Poland, Estonia, and Germany have experienced increased cyberattacks due to their support for Ukraine. Belarus's growing boldness in cyber activities supporting Russia poses a threat to European security. Alexander Leslie, a national security expert at Recorded Future, emphasizes the importance of tracking Belarus-linked cyber activities and distinguishing them from Russian operations. He advises that threat models should address credential theft and persistent access, focusing on the infrastructure and tools used by these actors. Organizations in government, transportation, and defense sectors supporting Ukraine may face intensified cyber campaigns aligned with Moscow's strategic interests. It is crucial for defenders to prioritize threats from Belarus-linked actors, as they continue to be active and evolve their techniques.