Introduction
Ghostwriter is referred as an ‘activity set’, with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.
Activities and Tactics
Targeted Sectors: Government
Country of Origin: 🏳️ Belarus
Risk Level: High
Suspected Victims: Germany, Latvia, Lithuania, Poland, Ukraine
Notable Campaigns
- 2021
- 2021-03
- 2022-01
- 2022-02
- 2022-03
- 2022-04
- 2024-04
- 2025-01
- German Parliament targeted again by Russian state hackers
- GhostWriter APT targets state entities of Ukraine with Cobalt Strike Beacon
- Ghostwriter
- Ghostwriter Update: Cyber Espionage Group UNC1151 Likely Conducts Ghostwriter Influence Activity
-
**Ghostwriter New Campaign Targets Ukrainian Government and Belarusian Opposition** - Ghostwriter/UNC1151
- In the past several days
- Malicious campaigns target government
- Operation Ghostwriter
- Operation “Asylum Ambuscade”
- Poland
- State Actor Uses Compromised Private Ukrainian Military Emails to Target European Governments and Refugee Movement
- UNC1151 Strikes Again: Unveiling Their Tactics Against Ukraine’s Ministry of Defence
- Ukraine links Belarusian hackers to phishing targeting its military
- Ukraine suspects group linked to Belarus intelligence over cyberattack
- a Belarusian threat actor
- a security researcher released a blog post detailing a ‘Browser in the Browser’ phishing technique.
- has conducted credential phishing campaigns over the past week against Polish and Ukrainian government and military organizations.
- has remained active during the course of the war and recently resumed targeting of Gmail accounts via credential phishing.
- https://about.fb.com/news/2022/02/security-updates-ukraine/
- https://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe/
- https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/
- https://blog.google/threat-analysis-group/update-threat-landscape-ukraine/
- https://blog.talosintelligence.com/malicious-campaigns-target-entities-in-ukraine-poland/
- https://content.fireeye.com/web-assets/rpt-unc1151-ghostwriter-update
- https://cyble.com/blog/unc1151-strikes-again-unveiling-their-tactics-against-ukraines-ministry-of-defence/
- https://securityaffairs.co/wordpress/129527/apt/ghostwriter-apt-targets-state-entities-of-ukraine-with-cobalt-strike-beacon.html
- https://www.bleepingcomputer.com/news/security/german-parliament-targeted-again-by-russian-state-hackers/
- https://www.bleepingcomputer.com/news/security/ukraine-links-belarusian-hackers-to-phishing-targeting-its-military/
- https://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails
- https://www.reuters.com/world/europe/exclusive-ukraine-suspects-group-linked-belarus-intelligence-over-cyberattack-2022-01-15/
- https://www.sentinelone.com/labs/ghostwriter-new-campaign-targets-ukrainian-government-and-belarusian-opposition/
- https://www.welivesecurity.com/2023/06/08/asylum-ambuscade-crimeware-or-cyberespionage/
- including Ukrainian military and public figures
- military and civilian entities in Ukraine
- recently introduced a new capability into their credential phishing campaigns. In mid-March
- we’ve seen increased targeting of people in Ukraine
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- Ghost
- Cobalt Strike:
- HALFSHELL:
- Impacket:
- RADIOSTAR:
- VIDEOKILLER:
Attribution and Evidence
Country of Origin: Belarus Additional attribution information pending cataloguing.
References
References pending cataloguing.