Ghostwriter
Aliases: UNC1151, TA445, PUSHCHA, Storm-0257, DEV-0257, UAC-0057
- First seen
- 2017-01-01 00:00:00
- Origin
- BY
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:34:17
Targeted industries: government-and-public-sector media-and-entertainment education-and-nonprofits
Targeted regions: country_code:pl country_code:lt country_code:lv country_code:ee
Context
Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.
Reports & references
- bsi.bund.de — Aktive Apt Gruppen Node (report)
- blog.google — Continued Cyber Activity In Eastern Europe Observed By Tag (report)
- blog.google — Fog Of War How The Ukraine Conflict Transformed The Cyber Threat Landscape (report)
- Mandiant — Ghostwriter Influence Campaign (report)
- twitter.com — 1377220336597483520 (report)
- Mandiant — Unc1151 Linked To Belarus Government (report)
- bleepingcomputer.com — Meta Ukrainian Officials Military Targeted By Ghostwriter Hackers (report)
- socprime.com — Uac 0057 Attack Detection A Surge In Adversary Activity Distributing Picassoloader And Cobalt Strike Beacon (report)
- socprime.com — Picassoloader And Cobalt Strike Beacon Detection Uac 0057 Aka Ghostwriter Hacking Group Attacks The Ukrainian Leading Military Educational Institution (report)
- CERT-UA — 5098518 (report)
- Microsoft — Microsoft Threat Actor Naming (report)