# Ghostwriter's Evolving Arsenal: Belarus-Aligned Threat Group Escalates Attacks on Ukrainian Government
## The Threat
The Belarus-aligned threat actor group known as Ghostwriter is actively escalating a sophisticated campaign targeting governmental and military organizations in Ukraine, according to new analysis from ESET researchers. The group, tracked under multiple aliases including FrostyNeighbor, PUSHCHA, Storm-0257, TA445, UAC-0057, Umbral Bison, and UNC1151, has maintained a persistent and evolving threat posture since at least 2016, shifting from cyber espionage to more aggressive operational activity against Eastern European targets.
Beginning in March 2026, Ghostwriter has deployed a refined attack chain that combines social engineering sophistication with technical evasion techniques. The campaign leverages spear-phished PDF documents that impersonate the legitimate Ukrainian telecommunications company Ukrtelecom, luring government employees into clicking malicious links. What distinguishes this campaign from routine phishing is the attacker's integration of geofencing technology—the malicious PDFs serve benign content to non-Ukrainian IP addresses while deploying the actual attack payload only to users accessing from within Ukraine's IP space. This selective targeting suggests meticulous operational planning and an understanding of government network boundaries.
Once a victim interacts with the malicious link, they receive a RAR archive containing a JavaScript payload that displays a legitimate-looking decoy document while silently executing PicassoLoader in the background. PicassoLoader then profiles and fingerprints the compromised host, sending system telemetry back to attacker-controlled infrastructure every 10 minutes. This reconnaissance phase allows Ghostwriter operators to manually assess whether each victim warrants further action before delivering Cobalt Strike Beacon—a commercial post-exploitation framework commonly used by both state-sponsored and financially-motivated threat actors. This multi-stage approach with human-in-the-loop decision making demonstrates operational maturity and a focus on quality over volume in targeting.
## Severity and Impact
| Aspect | Details |
|--------|---------|
| Threat Actors | Ghostwriter / FrostyNeighbor (Belarus-aligned) |
| Active Since | At least 2016; current campaign since March 2026 |
| Primary Targets | Ukrainian military, defense, and government sectors |
| Secondary Targets | Industrial, manufacturing, healthcare, logistics, and government in Poland and Lithuania |
| Attack Vector | Spear-phished PDF with embedded malicious links |
| Initial Payload | JavaScript-based PicassoLoader downloader |
| Final Payload | Cobalt Strike Beacon post-exploitation framework |
| Related CVEs Exploited | CVE-2023-38831 (WinRAR, CVSS 7.8), CVE-2024-42009 (Roundcube, CVSS 9.3) |
| Evasion Techniques | Geofencing, dynamic CAPTCHA checks, host fingerprinting, multi-stage delivery |
## Affected Products
Direct Attack Targets:
Vulnerable Technologies in Attack Chain:
Geographic Scope:
## Mitigations
Immediate Actions:
1. Email Security Hardening — Implement strict controls on PDF attachments, particularly those originating from external sources. Deploy sandboxing solutions that detonate suspicious PDFs in isolated environments before delivery to end users. Configure email gateways to flag or block archives (particularly RAR files) sent through phishing-prone vectors.
2. Geolocation-Based Awareness — While not foolproof, organizations should monitor for anomalous access patterns from unexpected geographic locations. Implement conditional access policies that flag or require additional authentication for connections originating outside expected government and organizational networks.
3. JavaScript Execution Controls — Disable or heavily restrict JavaScript execution in non-critical Windows environments. Where JavaScript must be enabled, implement application whitelisting to prevent unauthorized script execution. Monitor for suspicious JavaScript processes spawned from unusual parents (PDF readers, email clients).
4. Endpoint Detection and Response (EDR) — Deploy EDR solutions capable of detecting PicassoLoader behavior patterns, including suspicious system enumeration, credential access attempts, and network reconnaissance activity. Enable behavioral alerting for Cobalt Strike beacon characteristics (HTTP beaconing patterns, named pipe creation, process injection).
5. Credential Hygiene and Monitoring — Assume that spear-phishing campaigns will achieve some level of initial compromise. Implement robust password policies, multi-factor authentication (MFA) on all critical accounts, and continuous monitoring of credential usage. Organizations previously compromised via credential harvesting should enforce password resets.
6. Network Segmentation — Government and defense organizations should implement strict network segmentation to isolate critical systems from general office networks. Cobalt Strike's lateral movement capabilities become significantly less effective in segmented environments.
7. Threat Intelligence Integration — Monitor ESET's ongoing research on Ghostwriter's infrastructure and update network detection signatures accordingly. Coordinate with national cybersecurity agencies (SBU, CERT-UA, CISA) for shared indicators of compromise.
8. Security Awareness Training — While social engineering remains difficult to eliminate entirely, targeted training for government personnel on Ghostwriter's documented tactics—particularly the impersonation of Ukrtelecom and other legitimate Ukrainian entities—can reduce successful compromise rates.
## References
---
## HackWire Analysis
What makes Ghostwriter's current campaign particularly concerning is not the individual components—geofencing, JavaScript payloads, and Cobalt Strike are well-documented tactics—but the evident sophistication in combining them with human-directed targeting decisions. This is not a spray-and-pray phishing campaign. The integration of fingerprinting checks and manual operator review suggests that Ghostwriter is operating with clear target prioritization and is willing to invest operational resources in assessing victim value before deploying their most valuable capability: Cobalt Strike.
The timing and targeting also warrant scrutiny beyond the technical details. With Ukrainian government and military institutions as the explicit focus, this campaign appears directly aligned with geopolitical tensions in the region. The secondary targeting of organizations in Poland and Lithuania—NATO members—suggests either wider European destabilization objectives or opportunistic targeting of victims who may have less sophisticated defensive capabilities than their Ukrainian counterparts.
What's particularly notable is Ghostwriter's demonstrated ability to evolve. This group has transitioned from leveraging zero-days like WinRAR's vulnerability to incorporating CAPTCHA-based anti-analysis techniques and geofencing logic. They're not simply reusing old tools; they're actively engineering their delivery infrastructure in response to defensive measures. The fact that they've shifted to JavaScript-based payloads and RAR archives suggests they're actively monitoring which file types and execution methods encounter detection.
Organizations defending against this threat should focus less on any single indicator of compromise and more on detecting the *pattern* of Ghostwriter's behavior: credential harvesting preceding document lures, host fingerprinting activity, and suspicious JavaScript execution. The geofencing check is a detail that defenders can exploit—any PDF claiming to be from a Ukrainian entity but executing payloads regardless of geographic location is an immediate red flag.
For practitioners in Eastern Europe particularly, this campaign underscores that threat intelligence sharing and rapid patching are not optional defensive luxuries—they're critical infrastructure requirements. A vulnerability like CVE-2024-42009 in Roundcube becomes a full-scale supply chain attack vector when threat actors like Ghostwriter are actively developing exploits and deploying them against government targets.
— HackWire Editorial
## Related Coverage