unc1151-ghostwriter-update-report.pdf

Mandiant updates its July 2020 Ghostwriter analysis, reporting expanded narratives and TTPs—including the compromise of Polish officials' social-media accounts, fabricated articles on compromised sites, and targeted credential-harvesting—and assesses with high confidence that UNC1151 conducts at least some components of Ghostwriter activity; the report includes malware technical analysis (RADIOSTAR, VIDEOKILLER, HALFSHELL), extensive IOCs, infrastructure lists, case studies, and MITRE ATT&CK mappings to support detection and response.