Influence operation
Ghostwriter
Ghostwriter campaign
A long-running hack-and-leak and disinformation campaign against NATO's eastern members — Poland, Lithuania, Latvia and later Germany — that compromised news websites and officials' accounts to plant fabricated anti-NATO and anti-US content and forged documents, and to stoke Polish–Lithuanian tensions. Mandiant assessed with high confidence that the supporting group, UNC1151, is linked to the Belarusian government; in September 2021 the EU associated the activity with the Russian state after it targeted German lawmakers before the federal election.
Attribution carries a documented nuance. Mandiant attributes the technical operator, UNC1151, to Belarus with high confidence and could not rule out — but found no direct evidence of — a Russian contribution. The EU's 24 September 2021 declaration instead associated the broader Ghostwriter activity with the Russian state. Both point to a state-backed operation; they differ on which state is named.