- Category
- State · Attributed to a state or working for one.
- Origin
- Belarus(high confidence)
- Sponsor
- State-sponsored
- Motivation
- Financial Theft; Information theft and espionage; Sabotage and destruction; mainly financially motivated, additional espionage objective.
- Seen
- 2017–2022
- Status
- Dormant
- Sources
- 11 sources carry it
- Identifier
- GINC-APT-0046 · ghostwriter
BelarusWhat it is
Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CERT-UA
- UAC-0051, UAC-0057, UAC-0064, UAC-0105
- CrowdStrike
- White Lynx
- Mandiant
- UNC1151
- Microsoft
- Storm-0257, DEV-0257
- Proofpoint
- TA866, TA445
- PwC
- Blue Dev 4
- Operations
- Operation Ghostwriter, Operation “Asylum Ambuscade”
- Other names
- Asylum Ambuscade, Moonscape, PUSHCHA
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTBelarus
- MISP Galaxy (CFR tagging)Belarus
- ThreatActor.info (Malpedia et al.)Belarus
Targets
- Countries
- Belarus, Colombia, Estonia, France, Germany, Ireland, Kuwait, Latvia, Lithuania, Poland, Switzerland, Ukraine
- Sectors
- Defense, Education, Government, Media
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- Cobalt Strike
- Ghost
- HALFSHELL
- Impacket
- RADIOSTAR
- VIDEOKILLER
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de