Loading story…
Mandiant said the long-running Ghostwriter operation has continued to target audiences in Lithuania, Latvia, and Poland with cyber-enabled influence activity promoting narratives critical of NATO’s presence in Eastern Europe. The company reported that the campaign broadened beyond its earlier methods, expanding its narratives, targeting, and tactics while increasingly focusing on domestic political disruption in Poland through the use of compromised social media accounts belonging to Polish right-leaning officials.
According to Mandiant, the newer operations were conducted in Polish and English and relied less on website compromises, spoofed emails, and inauthentic personas than earlier Ghostwriter activity. Investigators found no evidence that social media platforms themselves were breached, assessing instead that attackers likely gained access through compromised email accounts and stolen credentials. Mandiant said newly obtained technical evidence supports a high-confidence assessment that espionage group UNC1151 conducts at least some components of Ghostwriter, and added that the group expanded credential-theft operations to target German politicians starting in 2021.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Mandiant said with high confidence that UNC1151 has links to the Belarusian government and that Ghostwriter activity is aligned with Belarusian government interests. The report said the campaign's messaging shifted after Belarus's disputed August 2020 election to defend Minsk, discredit the Belarusian opposition, and target Lithuania and Poland.
Based on newly obtained technical evidence, Mandiant assessed with high confidence that UNC1151 conducts at least some components of Ghostwriter influence activity, while noting it could not conclusively attribute all aspects of the campaign to the group.
Mandiant observed newer Ghostwriter operations using compromised social media accounts of Polish right-leaning officials to drive domestic political disruption in Poland. These operations were conducted in Polish and English and relied less on website compromises, spoofed emails, or inauthentic personas.
Since the start of 2021, Mandiant observed UNC1151 broaden its credential theft operations beyond earlier activity to include German politicians.
Mandiant's initial public report described Ghostwriter as an ongoing cyber-enabled influence operation targeting audiences in Lithuania, Latvia, and Poland with narratives critical of NATO's presence in Eastern Europe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
mandiant.com
Open sourcemandiant.com
Open sourcemandiant.com
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German authorities said the **Ghostwriter** group targeted members of the Bundestag and state parliaments in a phishing campaign designed to seize private email accounts. At least **seven federal lawmakers** and **31 state parliament members** were reportedly affected, along with political activists in Hamburg and Bremen. The attackers allegedly posed as legitimate security notifications from email providers, with addresses hosted by **GMX** and **T-Online** singled out in the operation. The activity fits Ghostwriter’s broader pattern of combining **credential theft**, social media and account takeovers, website compromises, fabricated content, and **hack-and-leak** tactics to push narratives aligned with anti-NATO and regional political objectives. Earlier reporting tied the campaign to Russian security interests and suspected **GRU** involvement, while later threat intelligence assessments attributed the operation to **Belarus-linked** actors, possibly connected to the Belarusian military and operating from Minsk, after the group’s focus expanded to dissidents, media figures, and neighboring governments including Poland and Lithuania.
Aug 15, 2026
CERT Polska warned that the Belarus-linked **GhostWriter** group, also tracked as `UNC1151` and `Storm-0257`, has intensified phishing against Gmail users in Poland after previously focusing on local providers such as Onet, Wirtualna Polska, and Interia. Since March, the campaign has increasingly targeted people involved in political and public life, including government officials, journalists, researchers, public administration staff, law enforcement personnel, and in many cases their relatives, personal contacts, and other socially connected individuals. The attackers are sending Polish-language emails masquerading as Gmail security or administrator alerts and directing victims to fake login pages designed to steal usernames, passwords, and two-factor authentication codes, including SMS and authenticator-app codes. CERT Polska said the group deploys new phishing domains and infrastructure almost daily, including attacker-registered domains, abused Netlify subdomains, and fake panels hosted on compromised Polish websites, while repeatedly pressuring the same targets with follow-up messages; successful account access can expose contacts and sensitive documents and enable further compromise of linked services such as social media.
Aug 14, 2026
UNC1151, also known as **Ghostwriter** and **FrostyNeighbor**, targeted Belarusian pro-democracy politician **Yury Hubarevich** with a phishing email masquerading as a Russian-language Google security alert. The lure redirected the victim through a compromised Ukrainian website to a counterfeit Gmail sign-in page that captured credentials in real time using a background WebSocket connection, a technique that can help attackers intercept session data and bypass SMS- or one-time-password-based MFA protections. Investigators linked the phishing page to a broader credential-theft infrastructure tied to UNC1151 by pivoting on certificates, server fingerprints, and hosting patterns. The network used domains such as `account[.]check-profile[.]digital`, hid backend systems behind **Bunny CDN** and **Cloudflare**, and exposed additional infrastructure on a Datagear-hosted IP in Poland. Researchers also found phishing pages impersonating Ukrainian services including **I.UA**, **bigmir)net**, and **META.UA**, indicating the operation extended beyond a single spear-phishing attempt and formed part of a wider campaign targeting users in Belarus and Ukraine.
Jul 12, 2026