GhostwriterThreat actor
- dev-0257
- pushcha
- storm-0257
- ta445
- UAC-0057
- UNC1151
Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.From MISP Galaxy
Last reported 27 days ago, by CERT-EU5 reports
ATT&CK techniques
6 of 19 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027”
- T1027.009Embedded Payloads
“T1027.009”
- T1036Masquerading
“Masquerading: Match Legitimate Resource Name or Location”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Cyber Brief 26-07 - June 2026“On the cyberespionage front, suspected Belarus-linked threat actor Ghostwriter reportedly engaged in a spearphishing campaign targeting Polish Gmail users, and the Belgian intelligence services were targeted by an unknown threat actor through Ivanti EPMM exploitation.”
-
UNC1151/Ghostwriter phishing campaign targeting Gmail accounts“UNC1151/Ghostwriter phishing campaign targeting Gmail accounts”
-
Оновлений інструментарій UAC-0057: OYSTERFRESH, OYSTERSHUCK та OYSTERBLUES“Оновлений інструментарій UAC-0057: OYSTERFRESH, OYSTERSHUCK та OYSTERBLUES”
-
FrostyNeighbor intensifica ataques en Ucrania con validación selectiva de víctimas“FrostyNeighbor, también conocido como Ghostwriter, UNC1151, UAC-0057, TA445, PUSHCHA o Storm-0257, es un grupo que presuntamente opera desde Bielorrusia..”
-
FrostyNeighbor: Fresh mischief and digital shenanigans“FrostyNeighbor, also known as Ghostwriter, UNC1151, UAC‑0057, TA445, PUSHCHA, or Storm-0257, is a group allegedly operating from Belarus.”
Indicators in its reports
named in the reports above- nkek.gov[.]uain 2 reports
- hxxps://book-happy.needbinding[.]icu/wp-content/uploads/2023/10/1GreenAM.jpgin 2 reports
- book-happy.needbinding[.]icuin 2 reports
- hxxps://nama-belakang.nebao[.]icu/statistics/discover.txtin 2 reports
- nama-belakang.nebao[.]icuin 2 reports
- 776a43e46c36a539…ee96e2392b39in 2 reports
- 8d1f2a6df51c7783…f8d032e5b57fin 2 reports
- b65551d339aece71…2c794c445efcin 2 reports
- e15abee1cfde8be7…50bad6bc0906in 2 reports
- 43e30be82d82b24a…6877e83f88abin 2 reports
- 4f2c1856325372b9…bc1a23bddd14in 2 reports
- d89e5524e49199b1…63c3f0a0c199in 2 reports
- 7e537d8e91668580…caba26d6bdacin 2 reports
- fa6882672ad36548…7c3fbade027ein 2 reports
- 3fa7d1b13542f1a9…9c250af68643in 2 reports
- 4e52c92709a91838…a257ace2780cin 2 reports
- 6fded427a16d5314…20dc84449769in 2 reports
- 27fa11f6a1d65377…4af47f211232in 2 reports
- attachment-storage-asset-static.needbinding[.]icuin 2 reports
- easiestnewsfromourpointofview.algsat[.]icuin 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.