Ghostwriter

🇧🇾Belarus-attributed

campaigns

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.

Threat Analysis

Ghostwriter is a known-sophistication threat actor attributed to Belarus, engaged in cyber operations with a primary motivation of unknown activity patterns.

Known Campaigns

Ghostwriter — Active Operations March 2026

Ghostwriter is a unknown-motivation threat actor attributed to Belarus. Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself....

ACTIVEMEDIUM2026

Intelligence Reports Mentioning Ghostwriter

Belarus-linked hackers target Gmail accounts of Polish public figures and their families

The Record· Jun 14, 2026

Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware

The Hacker News· May 22, 2026

Belarus-linked hackers use fake training certificates to target Ukrainian officials

The Record· May 21, 2026

Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike

The Hacker News· May 14, 2026

External References

→https://www.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-campaign.html

→https://twitter.com/hatr/status/1377220336597483520

→https://www.mandiant.com/resources/unc1151-linked-to-belarus-government

→https://www.bleepingcomputer.com/news/security/meta-ukrainian-officials-military-targeted-by-ghostwriter-hackers

→https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag

→https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/

→https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html

→https://socprime.com/blog/uac-0057-attack-detection-a-surge-in-adversary-activity-distributing-picassoloader-and-cobalt-strike-beacon/

→https://socprime.com/blog/picassoloader-and-cobalt-strike-beacon-detection-uac-0057-aka-ghostwriter-hacking-group-attacks-the-ukrainian-leading-military-educational-institution/

→https://cert.gov.ua/article/5098518

Quick Facts

TypeAPT / Threat Group

Origin🇧🇾 Belarus

Aliases7

SourceMalpedia

Also Known As

UAC-0057DEV-0257PUSHCHATA445GhostwriterStorm-0257UNC1151

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Ghostwriter