Ghostwriter
aka UNC1151, UAC-0057
A group linked to the Belarusian government that targets Ukraine's government and military and Belarusian opposition activists. It is also said to have supported disinformation campaigns.
- Alert level
- 1/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Assessed with high confidence as linked to the Belarusian government — Mandiant (Google)
- Assessed 2024-25 attacks as an extension of the long-running Ghostwriter operation — SentinelOne
How they attack
Entry
Lure spreadsheets
Like sending a file titled something irresistible, such as a list of political prisoners, that springs a trap when opened.
Inside
Picking victims before the payload
Like a courier who checks who opens the door before deciding whether to hand over the real package.
Goal
Swaying opinion with fake stories
Like pinning a convincing fake article on a hijacked news site's notice board.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily