The clearest escalation came in late May, when a group attributed to GhostWriter, a threat actor linked to Belarusian intelligence services, launched a destructive attack on a Ukrainian manufacturing company believed to be important to the country's transport sector. The hackers deployed data-wiping malware, which erases information from compromised systems. ESET said it was the first destructive cyberattack by a Belarus-aligned group its researchers had documented in Europe, a marked step up from the espionage and influence operations previously seen from such groups.

ESET could not determine whether the wiper was meant to cause damage or to cover the tracks of an espionage operation, but researchers said the attack "sets a precedent" and raises the possibility that other Belarus-aligned state groups could carry out similar attacks. They suggested Belarusian hacking groups are increasingly acting as proxies or "force multipliers" for Russia, and warned the trend could lead to shared tools and infrastructure, outsourced targeting or direct collaboration on attacks.

The report also noted that North Korean hackers have expanded their targeting of Ukrainian organisations, with some overlap with Moscow's intelligence interests, particularly around Ukraine's fast-growing drone industry. ESET said the evidence of North Korean operations directly supporting Russia's war effort was less definitive than the alignment observed among Belarusian groups.