Researchers at Mandiant have attributed Ghostwriter campaigns to the government of Belarus. Cybersecurity companies tend to use caution when attributing certain acts to threat groups, however, Mandiant identified the government with high confidence. Ghostwriter’s activities are linked to UNC115, a cybercriminal outfit also known to have ties to the Belarusian government. Earlier this year, sanctions were placed on Belarus over the forced diversion of a commercial plane into Belarus airspace to arrest a dissident journalist on the plane.
In retaliation, Belarus’s President Alexander Lukashenko has been accused of engineering a migrant crisis designed to destabilize the EU. The European Council has previously accused Russia of having involvement in Ghostwriter. However, Mandiant stated that although Russian interference cannot be entirely ruled out, other indicators suggest that Belarusian interests are at the core of the operation. The campaign has frequently targeted private sector and government entities in Ukraine, Lithuania, Latvia, Poland, and Germany. Additionally, Ghostwriter has been involved in attacks against Belarusian dissidents and journalists. The cybercriminal group was formerly focused on promoting anti-NATO content through phishing, spoofing, and other malicious acts.
Read More: Belarus government accused of ‘partial responsibility’ for Ghostwriter campaigns
