(FireEye) Mandiant Threat Intelligence has tied together several information operations that we assess with moderate confidence comprise part of a broader influence campaign—ongoing since at least March 2017—aligned with Russian security interests. The operations have primarily targeted audiences in Lithuania, Latvia, and Poland with narratives critical of the North Atlantic Treaty Organization’s (NATO) presence in Eastern Europe, occasionally leveraging other themes such as anti-U.S. and COVID-19-related narratives as part of this broader anti-NATO agenda. We have dubbed this campaign “Ghostwriter.” Many, though not all of the incidents we suspect to be part of the Ghostwriter campaign, appear to have leveraged website compromises or spoofed email accounts to disseminate fabricated content, including falsified news articles, quotes, correspondence and other documents designed to appear as coming from military officials and political figures in the target countries.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|
| Domain | Timestamp |
|---|
| URL | Timestamp |
|---|
Actor: Operation Ghostwriter
Names: Operation Ghostwriter, UNC1151, TA445, UAC-0051, PUSHCHA, DEV-0257, Storm-0257
Country: Belarus
Sponsor: State-sponsored
Motivation: Information theft and espionage
Motivation: Sabotage and destruction
First-seen: 2017
Description: (FireEye) Mandiant Threat Intelligence has tied together several information operations that we assess with moderate confidence comprise part of a broader influence campaign—ongoing since at least March 2017—aligned with Russian security interests. The operations have primarily targeted audiences in Lithuania, Latvia, and Poland with narratives critical of the North Atlantic Treaty Organization’s (NATO) presence in Eastern Europe, occasionally leveraging other themes such as anti-U.S. and COVID-19-related narratives as part of this broader anti-NATO agenda. We have dubbed this campaign “Ghostwriter.” Many, though not all of the incidents we suspect to be part of the Ghostwriter campaign, appear to have leveraged website compromises or spoofed email accounts to disseminate fabricated content, including falsified news articles, quotes, correspondence and other documents designed to appear as coming from military officials and political figures in the target countries.
Observed-sectors: Defense
Observed-sectors: Education
Observed-sectors: Government
Observed-sectors: Media
Observed-countries: Colombia
Observed-countries: Estonia
Observed-countries: France
Observed-countries: Germany
Observed-countries: Ireland
Observed-countries: Kuwait
Observed-countries: Latvia
Observed-countries: Lithuania
Observed-countries: Poland
Observed-countries: Switzerland
Observed-countries: Ukraine
Tools: Cobalt Strike
Tools: HALFSHELL
Tools: Impacket
Tools: RADIOSTAR
Tools: VIDEOKILLER
Operations: 2021
Operations: Ghostwriter Update: Cyber Espionage Group UNC1151 Likely Conducts Ghostwriter Influence Activity https://content.fireeye.com/web-assets/rpt-unc1151-ghostwriter-update
Operations: 2021-03
Operations: German Parliament targeted again by Russian state hackers https://www.bleepingcomputer.com/news/security/german-parliament-targeted-again-by-russian-state-hackers/
Operations: 2022-01
Operations: Ukraine suspects group linked to Belarus intelligence over cyberattack https://www.reuters.com/world/europe/exclusive-ukraine-suspects-group-linked-belarus-intelligence-over-cyberattack-2022-01-15/
Operations: 2022-02
Operations: Ukraine links Belarusian hackers to phishing targeting its military https://www.bleepingcomputer.com/news/security/ukraine-links-belarusian-hackers-to-phishing-targeting-its-military/
Operations: 2022-02
Operations: In the past several days, we’ve seen increased targeting of people in Ukraine, including Ukrainian military and public figures https://about.fb.com/news/2022/02/security-updates-ukraine/
Operations: 2022-02
Operations: Operation “Asylum Ambuscade” State Actor Uses Compromised Private Ukrainian Military Emails to Target European Governments and Refugee Movement https://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails https://www.welivesecurity.com/2023/06/08/asylum-ambuscade-crimeware-or-cyberespionage/
Operations: 2022-02
Operations: Ghostwriter/UNC1151, a Belarusian threat actor, has conducted credential phishing campaigns over the past week against Polish and Ukrainian government and military organizations. https://blog.google/threat-analysis-group/update-threat-landscape-ukraine/
Operations: 2022-03
Operations: GhostWriter APT targets state entities of Ukraine with Cobalt Strike Beacon https://securityaffairs.co/wordpress/129527/apt/ghostwriter-apt-targets-state-entities-of-ukraine-with-cobalt-strike-beacon.html
Operations: 2022-03
Operations: Ghostwriter, a Belarusian threat actor, recently introduced a new capability into their credential phishing campaigns. In mid-March, a security researcher released a blog post detailing a 'Browser in the Browser' phishing technique. https://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe/
Operations: 2022-04
Operations: Ghostwriter, a Belarusian threat actor, has remained active during the course of the war and recently resumed targeting of Gmail accounts via credential phishing. https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/
Operations: 2022-04
Operations: Malicious campaigns target government, military and civilian entities in Ukraine, Poland https://blog.talosintelligence.com/malicious-campaigns-target-entities-in-ukraine-poland/
Counter-operations: 2022 Early
Counter-operations: We’ve seen a further spike in compromise attempts aimed at members of the Ukrainian military by Ghostwriter, a threat actor tracked by the security community. https://about.fb.com/wp-content/uploads/2022/04/Meta-Quarterly-Adversarial-Threat-Report_Q1-2022.pdf
Information: https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/Ghostwriter-Influence-Campaign.pdf
Information: https://www.prevailion.com/diving-deep-into-unc1151s-infrastructure-ghostwriter-and-beyond/
Information: https://www.mandiant.com/resources/unc1151-linked-to-belarus-government
Information: https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf
Information: https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/
Last-card-change: 2023-09-05
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1583.001 ACQUIRE INFRASTRUCTURE : DOMAINS for operation ghost, apt29 registered domains for use in c2 including some crafted to appear as existing legitimate domains. T1587.001 DEVELOP CAPABILITIES : MALWARE for operation ghost, apt29 used new strains of malware including fatduke, miniduke, regduke, and polyglotduke. T1585.001 ESTABLISH ACCOUNTS : SOCIAL MEDIA ACCOUNTS for operation ghost, apt29 registered twitter accounts to host c2 nodes. | T1078.002 VALID ACCOUNTS : DOMAIN ACCOUNTS for operation ghost, apt29 used stolen administrator credentials for lateral movement on compromised networks. | T1546.003 EVENT TRIGGERED EXECUTION : WINDOWS MANAGEMENT INSTRUMENTATION EVENT SUBSCRIPTION during operation ghost, apt29 used wmi event subscriptions to establish persistence for malware. T1078.002 VALID ACCOUNTS : DOMAIN ACCOUNTS for operation ghost, apt29 used stolen administrator credentials for lateral movement on compromised networks. | T1546.003 EVENT TRIGGERED EXECUTION : WINDOWS MANAGEMENT INSTRUMENTATION EVENT SUBSCRIPTION during operation ghost, apt29 used wmi event subscriptions to establish persistence for malware. T1078.002 VALID ACCOUNTS : DOMAIN ACCOUNTS for operation ghost, apt29 used stolen administrator credentials for lateral movement on compromised networks. | T1027.003 OBFUSCATED FILES OR INFORMATION : STEGANOGRAPHY during operation ghost, apt29 used steganography to hide payloads inside valid images. T1078.002 VALID ACCOUNTS : DOMAIN ACCOUNTS for operation ghost, apt29 used stolen administrator credentials for lateral movement on compromised networks. | T1001.002 DATA OBFUSCATION : STEGANOGRAPHY during operation ghost, apt29 used steganography to hide the communications between the implants and their c&c servers. T1102.002 WEB SERVICE : BIDIRECTIONAL COMMUNICATION for operation ghost, apt29 used social media platforms to hide communications to c2 servers. |