Ghostwriter__2021__UNC1151_Assessed-with-High-Confidence-to-have-Links-to-Belarus_Mandiant.pdf

Mandiant assesses with high confidence that UNC1151 is linked to the Belarusian government and with moderate confidence to the Belarusian military; the group has conducted credential-harvesting phishing, proprietary malware-based intrusions (HIDDENVALUE, HALFSHELL), and supported the Ghostwriter information operations campaign targeting Belarusian neighbors and opposition interests since at least 2016. The report documents targeting patterns, technical links suggesting operators in Minsk, evolution of TTPs, and a shift in Ghostwriter narratives toward Belarusian government interests after the disputed 2020 elections, while noting uncertainty about who produces the operation's content and possible, but unproven, Russian involvement.