Introduction
Ghostwriter is referred as an ‘activity set’, with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.
Activities and Tactics
Targeted Sectors: Government
Country of Origin: 🏳️ Belarus
Risk Level: High
Suspected Victims: Germany, Latvia, Lithuania, Poland, Ukraine
Notable Campaigns
- Operation Ghostwriter
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- Ghost
Attribution and Evidence
Country of Origin: Belarus Additional attribution information pending cataloguing.
References
References pending cataloguing.