EU takes aim at Russia over 'Ghostwriter' hacking campaign against politicians, government officials

The European Union blamed Russia for the campaign and threatened unspecified action.

The European Union formally blamed Russia on Friday, just ahead of this weekend’s German elections, for a hacking campaign targeting EU government officials and politicians.

And the EU is threatening to take unspecified action. “The European Union will revert to this issue in upcoming meetings and consider taking further steps,” reads a statement from the high representative of the EU.

Known as Ghostwriter, the campaign drawing the EU’s ire has previously taken aim at NATO and launched disinformation efforts as well, according to researchers who have tied its goals to Russian interests but not attributed it to the government.

“The European Union and its Member States strongly denounce these malicious cyber activities, which all involved must put to an end immediately,” the EU statement reads. “We urge the Russian Federation to adhere to the norms of responsible state behaviour in cyberspace.”

The EU says that Ghostwriter targets in its member nations include civil society groups, government officials, parliaments, politicians and the press. The campaign has been “accessing computer systems and personal accounts and stealing data,” according to the statement.

The warning to Russia echoes Germany calling out the Kremlin over the Ghostwriter campaign earlier this month. Germany also had called attention to Ghostwriter targeting its parliament in March.

While the U.S. in the 2020 election might have avoided significant Russian election interference after the Kremlin’s hacking of Democratic emails and disinformation campaigns in 2016, by many accounts Russia has remained unrelenting in Europe. Russia routinely denies accusations of malfeasance in cyberspace.

In April, the cybersecurity firm FireEye linked Ghostwriter to 30 incidents in the last five years aimed at sowing political discord in places like Lithuania, Latvia and Poland to undermine NATO.

FireEye found ties between Ghostwriter and a cyber-espionage group that has been active since 2017. Prevailion also has scrutinized Ghostwriter activity.

Europe strikes out against Russia’s Turla over espionage, ‘destructive attacks’

The EU, its members and the U.K. took action against Russian government officials and others while attributing the winter cyberattacks against Poland’s energy grid to the FSB.

European-Chinese geopolitical issues drive renewed cyberespionage campaign

Potential EU law sparks global concerns over end-to-end encryption for messaging apps 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure