Ghostwriter__2022__UNC1151_Assessed_with_High_Confidence_to_have_Links_to_Belarus_Ghostwriter_Campaign_Aligned_with_Belarusian_Government_Interests_Mandiant.pdf

Mandiant assesses with high confidence that UNC1151 is linked to the Belarusian government and supports the Ghostwriter information operations campaign; the group has conducted credential-harvesting phishing (using GoPhish and spoofed domains), deployed proprietary malware families (HIDDENVALUE, HALFSHELL), and targeted governments, media, and dissidents across Ukraine, Poland, Lithuania, Latvia, and Germany. Technical reporting places operators in Minsk with ties to the Belarusian military, and since mid-2020 Ghostwriter narratives have shifted toward Belarus-aligned objectives; authorship of content and full malware development chain remain uncertain.