Mandiant links Belarus to Ghostwriter campaign, which leaked stolen data and pushed disinformation

The effort has boosted anti-NATO messaging and appeared similar to Russian disinformation outfits.

The Belarusian government is partially responsible for a years-long influence operation targeting Latvia, Lithuania and Poland, according to research published Tuesday.

Operation “Ghostwriter,” a propaganda campaign that has pushed fabricated narratives about the North Atlantic Treaty Organization and COVID-19, among other topics, is the work of people in Belarus, including the country’s military, as part of an overall effort to hack and leak information, pollute political discourse with amplified narratives, and collect intelligence, according to the threat intelligence firm Mandiant, which has tracked the group for years.

Investigators, including from the European Union, previously suggested that the operation aligned with Russian interests, as the social media campaigns apparently sought to sow mistrust in NATO’s military presence in Eastern Europe, a frequent goal of the Kremlin.

The findings show that complex information operations once associated with Russia and China have become more common, Ben Read, director of Mandiant’s cyber espionage team, told CyberScoop.

“The tools, the idea of doing these things, is accessible to a lot more people,” he said. “It’s a much more complicated field than five years ago.”

An EU spokesperson told CyberScoop that the EU has “seen the reports and are currently assessing the content. We welcome the researchers’ efforts to dig deeper and explain better to the public how those campaigns work. The report expands the body of evidence with regard to Ghostwriter attacks and other foreign information manipulation and interference/hybrid operations.”

The Ghostwriter group is accused of harvesting stolen passwords, leaking hacked data and to promoting specific political narratives. The European Union in September formally blamed the Russian government as being behind Ghostwriter, and called on Moscow “to adhere to the norms of responsible state behaviour in cyberspace.” The EU statement came out weeks after the German government accused the Russians of targeting German lawmakers ahead of elections in that country.

Suspected Russian operatives have used similar efforts, such as a group known loosely as Secondary Infektion, which has aimed to amplify attention on similar narratives.

Research published in April 2021 detailed how Ghostwriter dumped information that had been stolen from Polish officials’ social media accounts. Credentials for those accounts were taken by a hacking group known as UNC1151, a state-sponsored group distinct from other cyber threat groups, with the apparent goal of destabilizing the internal politics of several NATO countries.

Citing “sensitively sourced technical evidence,” Mandiant reports that the operators behind UNC1151 are likely located in Minsk, Belarus.

Separate technical evidence “supports a link” between UNC1151 and the Belarusian military. The details of the technical evidence, which Mandiant declined to share, has been “directly observed by Mandiant” and “confirmed with other sources. This data, combined with evaluation of targets and the content, provides proof of involvement from the Belarusian government of Aleksandr Lukashenko, an ally of the Russian government.

UNC1151 is thought to support the Ghostwriter campaign, but it remains unclear whether the Belarusian government is in full control.

“Since the disputed August 2020 elections in Belarus, Ghostwriter operations have been more distinctly aligned with Minsk’s interests,” Mandiant wrote. “Promoted narratives have focused on alleging corruption or scandal within the ruling parties in Lithuania and Poland, attempting to create tensions in Polish-Lithuanian relations, and discrediting the Belarusian opposition.”

The bulk of UNC1151’s activity is focused on Ukraine, Latvia, Lithuania, Poland and Germany. Its work also targets Belarusian dissidents, media entities and journalists.

European leaders have accused Lukashenko, the president of Belarus, of manufacturing an ongoing migrant crisis on the border with Poland in retaliation for sanctions imposed by the European Union after accusations of a rigged election. The 2015 migrant crisis in Europe destabilized the European Union, and the current situation is part of a “hybrid attack,” Ursula von der Leyen, the president of the European Commission in Washington, D.C., said last week.

“This is the attempt of an authoritarian regime to try and destabilize its democratic neighbors,” she said, calling it part of a pattern. “We see the cyber attacks, we see the misinformation, now we have this hybrid attack by instrumentalizing migrants and the EU/Belarus border.”

Updated, 11/19/21: To include comment from the EU.

Hackers with links to Pro-Russian groups compromised foreign embassies in Belarus, researchers say

The work has been carried out by a newly identified group dubbed "MustachedBouncer," according to researchers with ESET.

Russia’s digital warriors adapt to support the war effort in Ukraine, Google threat researchers say

Hacks, leaks and wipers: Google analyzes a year of Russian cyberattacks on Ukraine

Hacktivist personas back latest GhostWriter disinfo op targeting Poland, Ukraine

Mandiant: Belarusian disinformation operation pushes phony organ harvesting tale

Against backdrop of Russian-Ukraine war, researchers witness flurry of nation-aligned hacking

NATO countries’ refugee management may have been targeted by Belarus-linked hackers

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure