Cyber Threat Actor: Belarusian KGB

The Belarusian KGB is a Belarusian threat actor linked to government operations, conducting cyber espionage and influence campaigns. Public reporting attributes coordinated inauthentic behavior and cyber operations targeting Ukrainian institutions and individuals, particularly during periods of regional conflict. Their activities focus on Ukraine’s defense, telecommunications, and energy sectors, alongside journalists and activists, with strategic objectives centered on disinformation propagation and intelligence gathering. Meta’s March 2022 disruption revealed their collaboration with Russian state-aligned groups like the Internet Research Agency, reinforcing their state nexus. The actor’s operations align with Belarusian geopolitical interests, leveraging digital platforms to undermine Ukrainian morale and amplify false narratives.

This group employs fake accounts across Facebook, Instagram, and Telegram to disseminate fabricated claims, such as false reports of Ukrainian military surrenders. Phishing, credential theft, and malware facilitate cyber espionage against critical infrastructure and civil society targets. Coordinated mass reporting of invasion-related content further demonstrates their hybrid approach to platform manipulation. A notable campaign disrupted in early 2022 involved impersonating legitimate entities to compromise accounts and distribute malicious links, mirroring tactics used by Iranian and Azeri state-linked actors targeting similar sectors. Meta’s takedown highlighted the Belarusian KGB’s integration into broader Eastern European influence networks, though their tooling specifics remain less documented than those of Russian counterparts. Their operations reflect a persistent focus on blending cyber intrusions with psychological operations to destabilize adversaries.