| SYMBOL | COMMON_NAME | aka. SYNONYMS |
Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.
| 2026-05-14
⋅
ESET Research
⋅
FrostyNeighbor: Fresh mischief and digital shenanigans Cobalt Strike PicassoLoader |
| 2025-12-05
⋅
StrikeReady
⋅
Captch-ya if you can PicassoLoader |
| 2025-08-20
⋅
HarfangLab
⋅
UAC-0057 keeps applying pressure on Ukraine and Poland PicassoLoader |
| 2024-07-25
⋅
SOC Prime
⋅
UAC-0057 Attack Detection: A Surge in Adversary Activity Distributing PICASSOLOADER and Cobalt Strike Beacon Cobalt Strike PicassoLoader Ghostwriter |
| 2023-07-07
⋅
Cert-UA
⋅
UAC-0057 Targeted Cyber Attack Against Government Agencies Using PicassoLoader/njRAT (CERT-UA#6948) PicassoLoader Ghostwriter |
| 2023-06-16
⋅
SOC Prime
⋅
PicassoLoader and Cobalt Strike Beacon Detection: UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution Cobalt Strike PicassoLoader Ghostwriter |
| 2023-02-16
⋅
Google
⋅
Fog of war: how the Ukraine conflict transformed the cyber threat landscape APT28 Ghostwriter SaintBear Sandworm Turla |
| 2022-07-20
⋅
Mandiant
⋅
Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities Cobalt Strike GraphSteel GrimPlant MicroBackdoor |
| 2022-07-20
⋅
U.S. Cyber Command
⋅
Cyber National Mission Force discloses IOCs from Ukrainian networks Cobalt Strike GraphSteel GrimPlant MicroBackdoor |
| 2022-07-19
⋅
Google
⋅
Continued cyber activity in Eastern Europe observed by TAG CyberAzov APT28 Callisto Ghostwriter Sandworm Turla |
| 2022-04-29
⋅
AttackIQ
⋅
Attack Graph Response to UNC1151 Continued Targeting of Ukraine MicroBackdoor |
| 2022-04-07
⋅
InQuest
⋅
Ukraine CyberWar Overview CyclopsBlink Cobalt Strike GraphSteel GrimPlant HermeticWiper HermeticWizard MicroBackdoor PartyTicket Saint Bot Scieron WhisperGate |
| 2022-03-25
⋅
GOV.UA
⋅
Who is behind the Cyberattacks on Ukraine's Critical Information Infrastructure: Statistics for March 15-22 Xloader Agent Tesla CaddyWiper Cobalt Strike DoubleZero GraphSteel GrimPlant HeaderTip HermeticWiper IsaacWiper MicroBackdoor Pandora RAT |
| 2022-03-14
⋅
⋅
Qianxin
⋅
Analysis Of Attack Activities Of Suspected APT Organization UNC1151 Against Ukraine And Other Countries MicroBackdoor |
| 2022-03-08
⋅
Cluster25
⋅
GhostWriter / UNC1151 adopts MicroBackdoor Variants in Cyber Operations against Ukraine MicroBackdoor |
| 2022-03-07
⋅
⋅
Cert-UA
⋅
UAC-0051 (UNC1151) Cyberattack on Ukrainian State Organizations Using MicroBackdoor Malware (CERT-UA#4109) MicroBackdoor |
| 2022-02-28
⋅
Bleeping Computer
⋅
Meta: Ukrainian officials, military targeted by Ghostwriter hackers Ghostwriter |
| 2022-02-28
⋅
Bleeping Computer
⋅
Meta: Ukrainian officials, military targeted by Ghostwriter hackers Ghostwriter |
| 2021-11-16
⋅
Mandiant
⋅
UNC1151 Assessed with High Confidence to have Links to Belarus, Ghostwriter Campaign Aligned with Belarusian Government Interests Ghostwriter |
| 2021-05-04
⋅
Cr4sh / MicroBackdoor : Small and convenient C2 tool for Windows targets MicroBackdoor |
| 2021-03-31
⋅
Twitter (@hatr)
⋅
Tweet on Ghostwriter Ghostwriter |
| 2020-07-29
⋅
FireEye
⋅
'Ghostwriter' Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned With Russian Security Interests Ghostwriter |