Loading story…
German authorities said the Ghostwriter group targeted members of the Bundestag and state parliaments in a phishing campaign designed to seize private email accounts. At least seven federal lawmakers and 31 state parliament members were reportedly affected, along with political activists in Hamburg and Bremen. The attackers allegedly posed as legitimate security notifications from email providers, with addresses hosted by GMX and T-Online singled out in the operation.
The activity fits Ghostwriter’s broader pattern of combining credential theft, social media and account takeovers, website compromises, fabricated content, and hack-and-leak tactics to push narratives aligned with anti-NATO and regional political objectives. Earlier reporting tied the campaign to Russian security interests and suspected GRU involvement, while later threat intelligence assessments attributed the operation to Belarus-linked actors, possibly connected to the Belarusian military and operating from Minsk, after the group’s focus expanded to dissidents, media figures, and neighboring governments including Poland and Lithuania.
See the actors and campaigns active against you right now.
13 events from the most recent confirmed update back to the earliest known activity.
By April 2021, Mandiant attributed broader activity to Ghostwriter beyond fake articles, including compromising social media accounts of government officials to spread misinformation and targeting politicians in hacking and leaking operations.
After Belarus' disputed August 2020 election, Mandiant observed Ghostwriter shift toward Belarus-specific issues, including targeting dissidents, media figures, and neighboring governments such as Poland and Lithuania.
FireEye published research in July 2020 examining Ghostwriter as an influence campaign that used website compromises and fabricated content aligned with Russian security interests.
In the previous year, Germany's Federal Prosecutor obtained an arrest warrant for Russian hacker Dmitri Badin, alleging he played a key role in the 2015 Bundestag cyberattack and worked for the GRU.
On 25 September 2019, a false story published on a Baltic website claimed German NATO soldiers had desecrated a Jewish cemetery in Lithuania and used a manipulated photo.
A fabricated report dated 7 June 2018 claimed that a Lithuanian child had been run over by a NATO tank as part of Ghostwriter's anti-NATO disinformation efforts.
A false report dated 28 March 2017 alleged that a German Bundeswehr officer stationed with NATO in Lithuania was a Russian spy, illustrating Ghostwriter's early disinformation activity.
FireEye said the Ghostwriter influence campaign had been running since 2017, initially focusing on Lithuania, Latvia, and Poland with narratives intended to stir sentiment against NATO.
Mandiant concluded that the long-running Ghostwriter hacking and disinformation campaign was tied to Belarus rather than Russia, citing technical details suggesting operators were in Minsk and possible links to the Belarusian military.
In August, a Ghostwriter operation promoted a false narrative accusing migrants of committing crimes in Poland and Lithuania.
At the end of September, the European Union said some member states had associated Ghostwriter with the Russian state.
At least seven Bundestag members and 31 state parliament members were targeted in a phishing campaign aimed at taking over private email accounts; activists in Hamburg and Bremen were also reportedly attacked.
Germany's BSI and BfV sent warning letters to potential victims about a new phishing wave impersonating provider security messages and targeting GMX and T-Online addresses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
wired.com
Open sourcespiegel.de
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant said the long-running **Ghostwriter** operation has continued to target audiences in **Lithuania, Latvia, and Poland** with cyber-enabled influence activity promoting narratives critical of **NATO’s presence in Eastern Europe**. The company reported that the campaign broadened beyond its earlier methods, expanding its narratives, targeting, and tactics while increasingly focusing on domestic political disruption in Poland through the use of compromised social media accounts belonging to Polish right-leaning officials. According to Mandiant, the newer operations were conducted in **Polish and English** and relied less on website compromises, spoofed emails, and inauthentic personas than earlier Ghostwriter activity. Investigators found **no evidence that social media platforms themselves were breached**, assessing instead that attackers likely gained access through compromised email accounts and stolen credentials. Mandiant said newly obtained technical evidence supports a **high-confidence assessment** that espionage group **UNC1151** conducts at least some components of Ghostwriter, and added that the group expanded credential-theft operations to target **German politicians** starting in 2021.
Jun 29, 2026
CERT Polska warned that the Belarus-linked **GhostWriter** group, also tracked as `UNC1151` and `Storm-0257`, has intensified phishing against Gmail users in Poland after previously focusing on local providers such as Onet, Wirtualna Polska, and Interia. Since March, the campaign has increasingly targeted people involved in political and public life, including government officials, journalists, researchers, public administration staff, law enforcement personnel, and in many cases their relatives, personal contacts, and other socially connected individuals. The attackers are sending Polish-language emails masquerading as Gmail security or administrator alerts and directing victims to fake login pages designed to steal usernames, passwords, and two-factor authentication codes, including SMS and authenticator-app codes. CERT Polska said the group deploys new phishing domains and infrastructure almost daily, including attacker-registered domains, abused Netlify subdomains, and fake panels hosted on compromised Polish websites, while repeatedly pressuring the same targets with follow-up messages; successful account access can expose contacts and sensitive documents and enable further compromise of linked services such as social media.
Aug 14, 2026
Researchers reported that the suspected Russia-aligned **Doppelgänger** influence operation ran a coordinated propaganda campaign against German audiences from at least late 2023, using a large network of coordinated X accounts, impersonated media brands, and custom-built websites to push anti-government and anti-Ukraine narratives. The messaging focused on politically sensitive issues including strikes, immigration, inflation, and elections, with the activity assessed as part of a broader effort to shape public opinion in Germany. The operation relied on multi-stage redirection infrastructure and evasive technical measures, including Base64-obfuscated JavaScript, tracking identifiers, rotating first-stage and second-stage domains, geofencing on destination sites, and infrastructure linked to **Keitaro** traffic distribution systems. SentinelLABS and ClearSky said the campaign’s tactics and infrastructure overlap with findings previously reported by the German Ministry of Foreign Affairs, *Der Spiegel*, Recorded Future, and Meta, underscoring a persistent influence effort tied to upcoming European, municipal, state, and federal elections in Germany.
Jun 29, 2026