GhostWriter
Attribution profile
- Type
- Nation State
- Location
- Belarus
- Known incidents
- 4 incidents
- Sources
- 0 sources
- First seen
- 2022-01-13
- Last seen
- 2022-01-14
- Updated
- 2026-10-12 01:19
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
GhostWriter, also known as GhostWriter APT, is a threat actor associated with Belarus that has targeted Ukrainian government websites, exploiting CVE‑2021‑32648 in outdated content management systems to deface sites and post multilingual messages falsely claiming data theft. The observed activity focuses on disruption through website defacement and misinformation, with no evidence of financial gain or espionage in the reported incidents. Attribution links the group to Belarus‑based threat actors, though public sources do not explicitly confirm state sponsorship. A representative campaign occurred in January 2022, when multiple Ukrainian government portals—including the Ministry of Foreign Affairs, Cabinet of Ministers, and Ministry of Agriculture—were compromised and taken offline for restoration.
Incidents
Attributed incidents are available to members.
4 incidentsSources
Sources available to members: 0 sources.