UNC1151

Ghostwriter (technical support group)

A threat cluster that Mandiant assesses with high confidence is linked to the Belarusian government and provides technical support — credential theft and account compromise — to the Ghostwriter influence campaign against Poland, Lithuania, Latvia and Germany. Technical indicators place its operators in Minsk, with evidence of a link to the Belarusian military.