Ghostwriter is a Belarus-linked state-aligned group targeting governments with phishing and disinformation campaigns.
Ghostwriter is a Belarus-linked, nation-state aligned activity set targeting government entities. It primarily focuses on Germany, Latvia, Lithuania, Poland and Ukraine. Key TTPs include phishing, disinformation campaigns and document-based credential harvesting. Defenders should prioritize email security monitoring and user awareness against social engineering.
Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.
Ghostwriter primarily targets government entities in Germany, Latvia, Lithuania, Poland and Ukraine.
Key TTPs of Ghostwriter include phishing, disinformation campaigns and document-based credential harvesting.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.