Ghostwriter-Report-Final.pdf

This report consolidates open-source evidence on the Ghostwriter campaign, a long-running, multi-vector, state-aligned influence operation that combines cyber intrusions (website and social-media compromises, phishing and hack‑and‑leak) with fabricated content and impersonation to target NATO, Baltic states, Poland and Ukraine; it traces the campaign's evolution (2016–2021+), documents behavioural signatures and case studies, assesses attempts at attribution and mitigation by governments and platforms, and offers recommendations to improve detection, attribution, and coordinated responses.