EU takes aim at Russia over 'Ghostwriter' hacking campaign against politicians, government officials

guest · Sep 24, 2021

EU takes aim at Russia over 'Ghostwriter' hacking campaign against politicians, government officials
September 24, 2021
https://www.cyberscoop.com/eu-high-representative-ghostwriter-russia-warning-german-elections/

The European Union formally blamed Russia on Friday, just ahead of this weekend’s German elections, for a hacking campaign targeting EU government officials and politicians.

And the EU is threatening to take unspecified action. “The European Union will revert to this issue in upcoming meetings and consider taking further steps,” reads a statement from the high representative of the EU.
Click to expand...

Known as Ghostwriter, the campaign drawing the EU’s ire has previously taken aim at NATO and launched disinformation efforts as well, according to researchers who have tied its goals to Russian interests but not attributed it to the government.

The EU says that Ghostwriter targets in its member nations include civil society groups, government officials, parliaments, politicians and the press. The campaign has been “accessing computer systems and personal accounts and stealing data,” according to the statement.
Click to expand...

In April, the cybersecurity firm FireEye linked Ghostwriter to 30 incidents in the last five years aimed at sowing political discord in places like Lithuania, Latvia and Poland to undermine NATO.

FireEye found ties between Ghostwriter and a cyber-espionage group that has been active since 2017. Prevalion also has scrutinized Ghostwriter activity.
Click to expand...

guest · Oct 13, 2021

A Close Look at Russia's Ghostwriter Campaign
The group, which conducts espionage and sows disinformation, is larger than previously thought and has shifted tactics.
October 13, 2021
https://www.darkreading.com/vulnerabilities-threats/a-close-look-at-russia-s-ghostwriter-campaign

Known as "Ghostwriter," this espionage and disinformation operation has targeted several European countries, including Germany, Poland, Ukraine, and the Baltics (Estonia, Latvia, and Lithuania). In September, both Germany and the European Union officially attributed recent, targeted phishing campaigns to Russia generally and Russia's military intelligence apparatus (GRU) and the Ghostwriter operation specifically.

In August, our intelligence team uncovered new operational details for Ghostwriter/UNC1151, which we publicly released on Sept. 1.
Here is a closer look at what we found:
Click to expand...

Ghostwriter's Infrastructure Is Significantly Larger Than Previously Thought
We identified an additional 81 phishing domains associated with UNC1151 that were not previously reported, which makes this group's infrastructure nearly three-times larger than originally suspected.
This Infrastructure Was Well Hidden
There were no overt linkages between the new domains our team discovered and the previous domains reported by Mandiant. The group used entirely different — and largely legitimate-looking — registration information, login IPs, etc.

Many of the domains were still inactive, which suggests the threat actor anticipated some level of domain attrition and had prepared for it by establishing backups.
Click to expand...

Shifting Tactics
Our team also discovered domain and subdomain naming themes that indicate a change in Ghostwriter's targeting around 2020/2021.

The evidence shows that in late 2020 and early 2021, the actor began a shift in targeting as indicated by the choice of specific subdomains attached to the generic root domain: UNC1151 began using subdomains that appear to target an Eastern European audience. It is during this time that we see a large-scale phishing infrastructure built out to phish credentials across the user spectrum: [...]
Click to expand...

guest · Nov 17, 2021

Mandiant links Ghostwriter operations to Belarus
November 17, 2021
https://securityaffairs.co/wordpress/124675/apt/ghostwriter-operations-belarus.html

Mandiant Threat Intelligence researchers believe that the Ghostwriter disinformation campaign (aka UNC1151) was linked to the government of Belarus.

In August 2020, security experts from FireEye uncovered a disinformation campaign aimed at discrediting NATO by spreading fake news content on compromised news websites.
According to FireEye, the campaign tracked as GhostWriter, has been ongoing since at least March 2017 and is aligned with Russian security interests.
Click to expand...

Unlike other disinformation campaigns, GhostWriter doesn’t spread through social networks, instead, threat actors behind this campaign abused compromised content management systems (CMS) of news websites or spoofed email accounts to disseminate fake news.

The attackers used to replace existing legitimate articles on the sites with fake content, instead of creating new posts.
Click to expand...

According to a report published this week by Mandiant, Belarus was involved in the campaigns tracked as GhostWriter.

“Mandiant Threat Intelligence assesses with high confidence that UNC1151 is linked to the Belarusian government.” reads the report published by Mandiant.
“In April 2021, we released a public report detailing our high-confidence assessment that UNC1151 provides technical support to the Ghostwriter information operations campaign; this assessment, along with observed Ghostwriter narratives consistent with Belarusian government interests, causes us to assess with moderate confidence that Belarus is also likely at least partially responsible for the Ghostwriter campaign. We cannot rule out Russian contributions to either UNC1151 or Ghostwriter. “
Click to expand...

Mandiant: UNC1151 Assessed with High Confidence to have Links to Belarus, Ghostwriter Campaign Aligned with Belarusian Government Interests

UNC1151 has targeted a wide variety of governmental and private sector entities, with a focus in Ukraine, Lithuania, Latvia, Poland, and Germany. The targeting also includes Belarusian dissidents, media entities, and journalists. While there are multiple intelligence services that are interested in these countries, the specific targeting scope is most consistent with Belarusian interests. In addition to the targeting scope, UNC1151 operations have focused on obtaining confidential information and no monetization efforts have been uncovered.
Click to expand...

guest · Jan 4, 2023

Poland warns of attacks by Russia-linked Ghostwriter hacking group
By Bill Toulas @billtoulas - January 3, 2023

The Polish government is warning of a spike in cyberattacks from Russia-linked hackers, including the state-sponsored hacking group known as GhostWriter.
Click to expand...

In an announcement on Poland's official site, the government claims that hostile cyber-activities have intensified, targeting public domains and state organizations, strategic energy and armament providers, and other crucial entities.
The Polish believe Russian hackers target their country due to the continued support they have provided Ukraine in the ongoing military conflict with Russia.
Recent cyberattacks
The first case highlighted by the Polish government post is a DDoS (distributed denial of service) attack against the parliament website ('sejm.gov.pl'), attributed to the pro-Russian so-called hacktivists' NoName057(16).'

Another notable incident mentioned in the announcement is a phishing attack attributed to the 'GhostWriter' group, which the European Union has associated with the GRU, Russia's military intelligence service. Cybersecurity firm Mandiant has also linked the hacking group to the Belarusian government.
Click to expand...

According to the Polish, the Russian hackers set up websites that impersonate the gov.pl government domain, promoting fake financial compensation for Polish residents allegedly backed by European funds.

Clicking on the embedded button to learn more about the program takes victims to a phishing site where they are requested to pay a small fee for verification.
Click to expand...

GhostWriter has been active since at least 2017, previously observed impersonating journalists from Lithuania, Latvia, and Poland, to disseminate false information and anti-NATO narratives to local audiences.

The announcement warns that GhostWriter has been focusing on Poland recently, attempting to breach email accounts to collect information, and taking control of social media accounts to spread false information.
Click to expand...

Log in or Sign up

EU takes aim at Russia over 'Ghostwriter' hacking campaign against politicians, government officials

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

EU takes aim at Russia over 'Ghostwriter' hacking campaign against politicians, government officials

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches