The Belarusian government has been accused of at least “partial responsibility” for Ghostwriter attacks in Europe.
See also: Magniber ransomware gang: Exploits Internet Explorer flaws
While cybersecurity companies are often wary of attributing responsibility to a single malicious group, Mandiant says it is confident that Ghostwriter, which is also linked to UNC115 activities, is a cybercriminal group potentially working on behalf of the country's government.
Sanctions were imposed on Belarus earlier this year after the forced diversion of a commercial plane into Belarusian airspace to arrest a passenger, a journalist named Roman Protasevich. Now, in retaliation, the country’s president, Alexander Lukashenko, has been accused of creating a migration crisis to destabilize the EU.
However, it seems that all of this may go further, with the Ghostwriter's attribution to the ruling government.
The European Council has previously accused Russia of involvement in Ghostwriter.
See also: Ransomware – Ransom: How much do victims pay?
According to cybersecurity researchers, Russian interference cannot be "ruled out," but other indicators suggest that Belarusian interests are at the heart of the operation, which has typically targeted government and private entities in Ukraine, Lithuania, Latvia, Poland, and Germany.
In addition, Ghostwriter has also been involved in attacks against Belarusian dissidents, media outlets, and individual journalists.
See also: MediaMarkt hit by Hive ransomware
UNC1151 – active since 2016 – and Ghostwriter once focused on promoting anti-NATO material through phishing, spoofing , and hijacking vulnerable websites. However, since 2020, the groups have expanded their activities to efforts to influence Polish politics and steal sensitive information through credential theft.
UNC1151 also targeted Belarusian media and opposition members ahead of the 2020 elections, a disputed landslide victory. There have been no recorded attacks against Russian or Belarusian state entities
Many of Ghostwriter’s campaigns focus on anti-NATO narratives. Since mid-2020, the group has spread content accusing NATO of corruption, the military of spreading COVID-19 , and corruption in Lithuanian and Polish politics.
Information source: zdnet.com
