Actor
State agencyCorroborated
UNC1151
Ghostwriter (technical support group)
A threat cluster that Mandiant assesses with high confidence is linked to the Belarusian government and provides technical support — credential theft and account compromise — to the Ghostwriter influence campaign against Poland, Lithuania, Latvia and Germany. Technical indicators place its operators in Minsk, with evidence of a link to the Belarusian military.
Operations
Elections
Evidence Library
JournalismCyberScoop (reporting Mandiant)November 2021
Mandiant links Belarus to Ghostwriter campaign, which leaked stolen data and pushed disinformationOriginalArchived
JournalismCyberScoop (reporting Mandiant)November 2021
Mandiant links Belarus to Ghostwriter campaign, which leaked stolen data and pushed disinformationOriginalArchived