Article
Ghostwriter: Hybrid Influence and Espionage Operations in Eastern Europe
Ghostwriter (UNC1151, TA445, UAC-0057) profile: a Belarus-aligned group active since 2016 mixing disinformation, credential theft and espionage.
Read more
Significant cyber incident
Ghostwriter (UNC1151) campaigns against Poland, 2024 to 2026
Ghostwriter, which CERT Polska tracks as UNC1151, has run phishing, malware and disinformation campaigns against people and bodies in Poland since at least mid 2021.
In short
Ghostwriter, which CERT Polska tracks as UNC1151, has run phishing, malware and disinformation campaigns against people and bodies in Poland since at least mid 2021. CERT Polska's reports for 2024, 2025 and June 2026 describe stolen mailbox logins, an exploited webmail flaw, election related disinformation and, from March 2026, phishing aimed at Gmail users. Targets are politicians, officials, journalists and researchers.
What happened
On 19 July 2022 CERT Polska, the Polish national response team run by the research institute NASK, wrote that the group it calls UNC1151/Ghostwriter had for over a year been attacking the mailboxes of Polish citizens. It counted nearly 100 domains set up in the previous year for attacks on Polish speakers. In one case the attacks reached the mailboxes of members of parliament.
CERT Polska’s annual report for 2024 says the group kept up this activity. For most of the year it ran an e-mail campaign that used account suspension and password changes as the excuse. It also sent malware inside files that looked like invitations to industry events. In June 2024 CERT Polska worked on a case at a Polish national sports body. It found the intruder had probably used a flaw in one of the systems and then resold the access to others. Data about Polish athletes was stolen, and at the end of the Paris Olympics it was published on a Telegram channel linked to the group, together with disinformation about doping.
In 2025 the group repeatedly used a flaw in the Roundcube webmail program (CVE-2024-42009) to steal logins. CERT Polska reported the first such campaign on 5 June 2025. In March 2025 CSIRT NASK also saw the group running disinformation around the presidential election. On 12 June 2026 CERT Polska reported that since March 2026 the group had been phishing Gmail users, including their second login code.
CERT Polska says published work links UNC1151 to the Belarusian government, and that other sources point to Russian intelligence. See the attribution note.
Timeline
-
19 July 2022
CERT Polska says UNC1151/Ghostwriter has for over a year been attacking the mailboxes of Polish citizens.
-
2022
CERT Polska counts nearly 100 domains set up in the previous year for attacks on Polish speakers.
-
2024
The group runs a large e-mail campaign using account suspension and password change messages.
-
2024
The group sends malware in files that look like invitations to industry events; infected systems download Cobalt Strike.
-
June 2024
CERT Polska speaks with a Polish national sports body about a possible malware infection.
-
End of the Paris Olympic Games, 2024
The body's website is hacked and stolen athlete data is published on a Telegram channel linked to the group.
-
March 2025
CSIRT NASK sees UNC1151 activity tied to the upcoming presidential elections.
-
5 June 2025
CERT Polska reports a spear phishing campaign that exploits the Roundcube flaw CVE-2024-42009 to steal logins.
-
2025
The group repeatedly exploits the same flaw; APT28 also uses it against Polish entities.
-
March 2026
The group starts phishing campaigns aimed at Gmail users.
-
12 June 2026
CERT Polska publishes its analysis of the Gmail campaign and says the second login factor is also phished.
How the attack worked
Step 1: the lure
The e-mails pretend to come from a mail provider. In 2024 and 2025 CERT Polska describes messages about account suspension and password changes, aimed at users of Polish providers such as Interia, Onet and Wirtualna Polska. From March 2026 the same kind of message targeted Gmail users. CERT Polska says the group sometimes does not know whose mailbox it is writing to. It also says the campaigns run regularly, from Monday to Friday, over many weeks. The technique matches Phishing (T1566).
Step 2: stealing the login
A fake login page collects the address and password. In the Gmail campaign the page also asks for the second login code, and the attackers then try to log in automatically. In the June 2025 campaign no fake page was needed. Opening the e-mail was enough to exploit the Roundcube flaw CVE-2024-42009. The exploit installed a Service Worker, a browser feature that runs in the background. It copied every genuine login to a server the attackers controlled.
Step 3: using the mailbox
CERT Polska says the attackers then read the mailbox, download the address book and sometimes send more phishing from the account. Taken mailboxes are searched for sensitive documents and used to take over linked social media accounts. The group reused real messages from taken accounts and attached the exploit to them, so new targets saw a mail they could trust. Using stolen logins matches Valid Accounts (T1078).
Other tools in the same period
In malware attacks the group used files that looked like invitations to industry events, mostly CHM help files in 2025. Infected systems downloaded Cobalt Strike. In 2025 it also used a fake CAPTCHA, known as ClickFix, on agriculture related websites it had gained access to.
Disinformation
The group also publishes material. In March 2025 it used the image of a Ukrainian foundation and of election candidates, promoted it through YouTube and TikTok advertising and posted it in OLX auction descriptions. CERT Polska says the aims included deepening polarisation and inciting hostility toward the Ukrainian minority in Poland.
- Phishing e-mailFake provider message about account suspension or a password change, or a mail that carries the Roundcube exploitTechnique T1566 (MITRE ATT&CK, opens in a new tab)
- Login theftFake login page, or a Service Worker, copies the password; in 2026 the second code is phished tooTechnique T1078 (MITRE ATT&CK, opens in a new tab)
- Automatic loginCERT Polska says the attackers then try to log in to the account automatically
- Mailbox useRead mail, download the address book, send more phishing, take over linked accounts
- DisinformationMaterial is used in propaganda, for example the Telegram release of athlete data
ATT&CK techniques
- Technique Phishing (T1566): ATT&CK Technique Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password. T1566 · Initial Access
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
CERT Polska, 8 April 2026 (annual report for 2025): says UNC1151 is a cluster it attributes to APT activity, that published work links the group to the Belarusian government, and that other sources also point to connections with Russian intelligence services.
CERT Polska, 5 June 2025: attributes the Roundcube campaign to a UNC1151 cluster with high confidence, based on technical indicators.
Sources differ on which state stands behind the group: Belarus in the first view, Russian intelligence in the other. CERT Polska reports both. The Polish government statements on this group were not opened for this page.
Malware and vulnerabilities used
Impact
CERT Polska gives no total number of victims. It says the 2024 e-mail activity was on a large scale and that the 2025 e-mail campaigns targeted hundreds of individuals. It says the group's interests are very broad: politically active people, people in prominent posts, researchers, journalists, public administration and uniformed services staff, and people linked to them by family or friendship. Known harm in 2024: athlete data stolen from a Polish national sports body and published. Known harm to individuals: stolen mailbox logins that give access to messages, contact lists and linked accounts. CERT Polska does not give counts of taken mailboxes.
Government and regulator response
CERT Polska, 5 June 2025: advised all Roundcube users to update to the current version, to check network logs and received mail for the listed indicators, and, for targeted organizations, to reset passwords, check user activity and remove installed Service Workers. It asked all Polish entities that got similar messages to report to the CSIRT for their group: CSIRT NASK, CSIRT MON or CSIRT GOV.
CERT Polska, 12 June 2026: published the Gmail analysis, with domains and example messages, and urged readers to learn how to use e-mail and social media safely and to report suspicious sites through its incident form.
CSIRT NASK, March 2025: monitored the election related campaigns together with the NASK Information Protection Division of Cyberspace.
Lessons
-
Hijacked mail is a way into people
The group's aim is the mailbox itself: messages, contacts and linked accounts. Treat private and webmail accounts of staff in sensitive roles as part of your risk.
-
Second factor codes can be phished
The 2026 pages ask for the second code and use it at once. App codes and text codes are not enough against this kind of page; hardware keys or passkeys are stronger.
-
Patch webmail fast
The June 2025 exploit worked on installations that were not updated, and opening the mail was enough. Webmail needs the same patch discipline as other internet services.
-
Trusted senders carry the attack
The group reused real messages from taken accounts, so one stolen mailbox helps attack the next organization.
-
Report and share
CERT Polska relies on reports from people and organizations to track new domains almost daily. Reporting quickly helps others.
-
Disinformation is part of the attack
Stolen data was published with doping claims; election material was promoted through ads. Plan communication for the day stolen data appears.
What to check in your own organization
-
Webmail patch level
If you run Roundcube or any webmail, confirm it is on a current release and check whether CVE-2024-42009 was fixed.
-
Service Workers
In webmail sessions, check whether unknown Service Workers are registered in staff browsers after a suspicious mail.
-
Second factor type
Check which staff and board members still use text or app codes, and move high risk people to hardware keys or passkeys.
-
Staff private accounts
Offer guidance to politically exposed or senior staff on securing their personal Gmail and other mail accounts.
-
Lookalike domains
Watch for new domains that copy your mail provider or brand, especially with unusual endings.
-
Address book exposure
Check what a stolen mailbox would reveal, and limit shared contact lists and old attachments.
-
Reporting route
Make sure staff know where to report a suspicious mail and that you tell the national CSIRT when you see a campaign.
Where it happened
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
- Country Poland Poland faces cyber threats from state-linked actors such as APT28, Sandworm and Dragonfly, and from ransomware families such as LockBit. Europe
Questions
Who is UNC1151?
CERT Polska tracks it as a cluster it attributes to APT activity. It says published work links the group to the Belarusian government and other sources point to Russian intelligence. It is also called Ghostwriter.
Is Ghostwriter the same as UNC1151?
CERT Polska said in July 2022 that Ghostwriter first named the operation, and that the two names are now used interchangeably.
What did the 2025 Roundcube campaign do?
Opening the e-mail exploited CVE-2024-42009 and installed a Service Worker that copied genuine logins to an attacker server, according to CERT Polska.
What changed in 2026?
CERT Polska says that since March 2026 the group has run phishing campaigns against Gmail users, and that it also phishes the second login factor.
Who was targeted?
Politically active people, people in prominent posts, researchers, journalists, public administration and uniformed services staff, and people close to them, according to CERT Polska.
What was published from the sports body case?
CERT Polska says stolen data about Polish athletes was published on a Telegram channel linked to the group after the Paris Olympics, together with doping disinformation.
Sources
- Development of attack techniques of the UNC1151/Ghostwriter group (19 July 2022, in Polish) CERT Polska
- Annual report of CERT Polska 2024 CERT Polska
- UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign (5 June 2025) CERT Polska
- Annual report of CERT Polska 2025 CERT Polska
- UNC1151/Ghostwriter phishing campaign against Gmail (12 June 2026, in Polish) CERT Polska
- CERT Polska home page (role as CSIRT NASK) CERT Polska
- MITRE ATT&CK, T1566 Phishing MITRE
- MITRE ATT&CK, T1078 Valid Accounts MITRE
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.