Ghostwriter
No sourced public emblem in this profile.
reference profile · reported nexus: BY (not nationality)
Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.
Source-reported aliases: UNC1151, TA445, PUSHCHA, Storm-0257, DEV-0257, UAC-0057. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): Germany ·
Latvia ·
Lithuania ·
Poland ·
Ukraine
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-campaign.html
https://twitter.com/hatr/status/1377220336597483520
https://www.mandiant.com/resources/unc1151-linked-to-belarus-government
https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag
https://cert.gov.ua/article/5098518