Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Ghostwriter · Nation-state · assessed origin Belarus · misp-galaxy · refreshed 2026-10-06

Ghostwriter

  • UNC1151
  • TA445
  • PUSHCHA
  • Storm-0257
  • DEV-0257
  • UAC-0057

state sponsor · Belarus

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE1 new CVE: CVE-2023-38831

Analyst brief

misp-galaxy

Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.

Observed targets (as stated by the sources)

5 countries · 1 sectors
GermanyLatviaLithuaniaPolandUkraineAssessed origin: Belarus

assessed origin · Belarusobserved targets · 5

countries · 5

  • Germany
  • Latvia
  • Lithuania
  • Poland
  • Ukraine

sectors · 1

  • Government

as stated by MISP galaxy / ransomware.live — not inferred

CVEs Ghostwriter is cited as exploiting

none on KEV
  1. CVE-2023-388312026-10-17
    1. “in September 2023, UAC-0057 launched a malicious campaign against the Ukrainian government and educational institutions, abusing a WinRAR zero-day (CVE-2023-38831) to deliver PICASSOLOADER.”

      cited as exploiting · source: socprime.com ↗ · 2026-10-17

    2. “It has been observed that APT group DarkPink in Southeast Asia, APT group Konni in East Asia and APT group GhostWriter in Eastern Europe use CVE-2023-38831 vulnerabilities to carry out cyberattack activities.”

      cited as exploiting · source: nsfocusglobal.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

10 sources
  1. 1.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-cam…
  2. 2.twitter.com/hatr/status/1377220336597483520
  3. 3.mandiant.com/resources/unc1151-linked-to-belarus-government
  4. 4.bleepingcomputer.com/news/security/meta-ukrainian-officials-military-target…
  5. 5.blog.google/threat-analysis-group/continued-cyber-activity-in-east…
  6. 6.blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-confl…
  7. 7.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherh…
  8. 8.socprime.com/blog/uac-0057-attack-detection-a-surge-in-adversary-ac…
  9. 9.socprime.com/blog/picassoloader-and-cobalt-strike-beacon-detection-…
  10. 10.cert.gov.ua/article/5098518

Track Ghostwriter on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.