KINWILDER

Ghostwriter

No sourced public emblem in this profile.

reference profile · reported nexus: BY (not nationality)

Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.

Source-reported aliases: UNC1151, TA445, PUSHCHA, Storm-0257, DEV-0257, UAC-0057. Associations do not prove equivalence.

Target geography

Catalog-listed countries (associations, not attack counts): Germany · Latvia · Lithuania · Poland · Ukraine

No bound claim-post feed for this label.

Historical casebook

No dated record curated yet; absence does not establish inactivity.

Planned Kinwilder coverage

Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.

No assigned review window.

References

Pinned source catalog

https://www.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-campaign.html

https://twitter.com/hatr/status/1377220336597483520

https://www.mandiant.com/resources/unc1151-linked-to-belarus-government

https://www.bleepingcomputer.com/news/security/meta-ukrainian-officials-military-targeted-by-ghostwriter-hackers

https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag

https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/

https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html

https://socprime.com/blog/uac-0057-attack-detection-a-surge-in-adversary-activity-distributing-picassoloader-and-cobalt-strike-beacon/

https://socprime.com/blog/picassoloader-and-cobalt-strike-beacon-detection-uac-0057-aka-ghostwriter-hacking-group-attacks-the-ukrainian-leading-military-educational-institution/

https://cert.gov.ua/article/5098518

Submission and profile-update guide · Publisher API

Editorial standard · root@kinwilder.com · RSS · Outpost