Ghostwriter
Also known asUNC1151 · UAC-0051 · TA445 · UAC-0057 · Operation Ghostwriter · PUSHCHA · DEV-0257 · Storm-0257 · White Lynx · Blue Dev 4 · Moonscape · FrostyNeighbor
Summary
Belarus-linked operation (Mandiant's UNC1151, assessed high-confidence Belarusian government; Proofpoint TA445, CERT-UA UAC-0057) that pairs credential theft and intrusions with the 'Ghostwriter' influence campaign — compromised social-media and news-site accounts used to plant anti-NATO content in Poland, Lithuania, Latvia and Ukraine. Mandiant links UNC1151 to the Belarusian government with high confidence and to the Belarusian military with moderate confidence; Germany's government (Sep 2021) attributed Ghostwriter to Russia's GRU and the EU's declaration addressed the Russian Federation; the attribution is therefore contested between state-level (Russia) and vendor technical (Belarus) assessments. Recent activity: Gmail credential and 2FA-code phishing against Polish public figures and a Belarusian politician (Mar–Jun 2026, CERT Polska); Prometheus-certificate lures delivering the OYSTERFRESH → OYSTERSHUCK → OYSTERBLUES chain and Cobalt Strike against Ukrainian government bodies (Mar–May 2026, CERT-UA); Roundcube XSS CVE-2024-42009 credential theft in Poland (Jun 2025); macro-XLS / PicassoLoader lures against the Belarusian opposition and Ukraine's MoD (late 2024–early 2025, SentinelLABS).
Attribution
Mandiant: Belarus; German government and EU: Russia
Credible sources disagree on who is responsible.
- Mandiant (Research, 2021-11-16)
High confidence: linked to the Belarusian government (military: moderate) - German Foreign Office, via BleepingComputer (Government, 2021-09-24)
Attributes Ghostwriter to Russia's GRU - Council of the EU, via BleepingComputer (Government, 2021-09-24)
Declaration addressed to the Russian Federation
Campaigns 5
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 5
| Reconnaissance1 | T1598.003Spearphishing Link |
|---|---|
| Initial Access1 | T1566.002Spearphishing Link |
| Execution2 | T1059.007JavaScriptT1059.005Visual Basic |
| Credential Access1 | T1111Multi-Factor Authentication Interception |
Malware and tools 6
| Name | Description | Platform |
|---|---|---|
| MicroBackdoor | Lightweight Backdoor | Windows |
| OYSTERFRESH | JS Dropper | Windows |
| OYSTERSHUCK | JS Decoder | Windows |
| OYSTERBLUES | JS Backdoor | Windows |
| Cobalt Strike | Post-exploitation Framework | Windows |
| PicassoLoader | Downloader | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2024-42009 | 9.3 | Roundcube Webmail — cross-site scripting (KEV 2025-06-09) |
Highest CVSS first.
Infrastructure patterns
- Credential-theft domains spoofing webmail and target sites, e.g. mail.kuwaitarmy.gov-kw.ml (Mandiant, 2021)
- Russian-language Telegram channels run as information-operation assets (Mandiant, 2021)
Reporting and advisories 6
- EU
EU Declaration Condemning Ghostwriter/UNC1151 (2021) - CERT Polska
Polish Roundcube credential theft (CVE-2024-42009) - CERT-UA
Prometheus-lure OYSTER chain — Ukrainian government - SentinelLABS
Belarusian opposition & Ukrainian MoD — macro XLS / PicassoLoader - CERT Polska
Gmail credential and 2FA-code phishing against Polish public figures - ESET Research
ESET APT Activity Report Q2–Q3 2026 (Oct 2026)