UNC1151
Ghostwriter is a long-running cyber-enabled influence and espionage threat actor/campaign also tracked as UNC1151 and UAC-0057. The content describes it as Belarus-aligned or Belarus-linked, with multiple reports linking it to Belarusian state intelligence services, while other cited government statements and reporting associate Ghostwriter activity with the Russian state or Russian special services. Mandiant assessed with high confidence that UNC1151, a suspected state-sponsored cyber espionage actor, conducts at least some components of Ghostwriter activity, but stated that intelligence gaps prevent conclusive attribution of all Ghostwriter activity to UNC1151. Ghostwriter has primarily targeted audiences and organizations in Lithuania, Latvia, and Poland, promoting narratives critical of NATO’s presence in Eastern Europe and seeking to undercut regional security cooperation. Reported activity includes disinformation, hack-and-leak operations, false-flag activity, website compromises used to publish fabricated stories, spoofed emails, use of inauthentic personas, and compromise of social media and email accounts. More recent operations cited in the content used compromised social media accounts of right-leaning Polish officials to create domestic political disruption in Poland, and UNC1151-linked credential theft activity expanded to target German politicians. The content also describes sustained phishing, credential harvesting, and malware delivery operations attributed to UAC-0057 / UNC1151 / Ghostwriter against Ukrainian government organizations. CERT-UA reported campaigns using macro-enabled lure documents to launch PICASSOLOADER and deliver Cobalt Strike Beacon, as well as exploitation of WinRAR vulnerability CVE-2023-38831 using BAT, LNK, HTA, JavaScript, and SVG-hosted payloads that ultimately deployed Cobalt Strike Beacon. In 2026 reporting, Ghostwriter targeted Ukrainian government entities with Prometheus-themed phishing sent from compromised accounts. Those campaigns used PDF lures leading to ZIP archives containing JavaScript malware identified as OYSTERFRESH, which displayed decoy content, stored OYSTERBLUES in the Windows Registry, launched OYSTERSHUCK to decode it, profiled infected hosts, sent host data to command-and-control infrastructure via HTTP POST, and could lead to delivery of Cobalt Strike. Additional reporting cited JavaScript-based PicassoLoader variants, geofenced delivery to Ukrainian IP space, persistence via registry Run keys or scheduled tasks, infrastructure hidden behind Cloudflare, and frequent use of .icu domains. Reported targeting in the content includes government officials, politicians, journalists, civil society, military and defense-related entities, and government organizations in Eastern Europe, especially Poland, Lithuania, Latvia, Germany, and Ukraine.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
40 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
13 malware families attributed to this actor across reporting.
8 additional families tracked in Mallory.
Associated vulnerabilities
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
CERT Poland on Friday warned that threat actors are exploiting a Roundcube XSS flaw in a spear-phishing campaign aimed at credential theft. CERT Poland attributed the activity to the Belarusian hacking group UNC1151. Tracked as CVE-2024-42009, the flaw leads to JavaScript code execution when opening an email.
CERT-UA reported a cyberattack by UAC-0057 involving the file "Збірник_тез_НУОУ_23.rar", which contains an exploit for CVE-2023-38831. Successful exploitation leads to execution of a BAT file, then an LNK file, then an HTA via mshta.exe, ultimately delivering Cobalt Strike Beacon. The notice also states there is active exploitation of CVE-2023-38831 in WinRAR and that a PoC for generating ZIP archives with the required structure is publicly available.
StrikeReady reports a then-zero-day in Zimbra Collaboration Suite (CVE-2025-27915) delivered via a malicious .ICS calendar file (large ICS containing JavaScript), used to target Brazil’s military; notes a Russian-linked group as prolific and mentions UNC1151 using similar TTPs.
Observables
194 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting phishing campaigns against Ukrainian government organizations using compromised email accounts and PDF lures that deliver a multi-stage malware chain culminating in Cobalt Strike. The group is also described as having run disinformation operations and campaigns targeting Belarusian opposition activists and Ukrainian military and government entities.
Associated with use of PicassoLoader in campaigns referenced in the report.
Conducting phishing-based intrusion campaigns against Ukrainian government organizations using compromised accounts and multi-stage malware delivery that culminates in Cobalt Strike deployment.
Phishing campaign targeting Ukrainian government organizations using compromised accounts and Prometheus-themed lures to deliver multi-stage malware and ultimately Cobalt Strike.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.