Unmasking UNC1151, the Ghost Behind Ghostwriter
summary
Claims that UNC1151 provides operational support to Ghostwriter campaigns targeting Poland Lithuania Latvia and Ukraine since 2017, using GoPhish infrastructure to send phishing emails that lead to credential‑harvest sites and occasional attachments that drop Half Shell .NET malware. Operations post‑Aug 2020 shift toward Belarus‑focused IO — falsified articles on compromised news sites, persona accounts, bomb threats — with technical indicators suggesting links to Minsk and Belarus military; UNC1151→Belarus high confidence, Ghostwriter→Belarus moderate confidence.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:28Acknowledgements
- 1:24Background
- 9:20August 2020
- 15:02Targeted Countries
- 16:05Technical Indicators
- 17:15Belarus Cyber Capabilities
- 19:35Analysis
related talks
42mDriven Response to UNC5174
49mConducting a Successful False Flag Cyber Operation (Blame it on China)
28mOperation Ghost: The Dukes aren’t back - they never left!
08mBarely Whispering
12mNDP: Polish-Language IO Campaign’s Role within RU’s Prop. and Disinfo. Ecosystem
45mHiding in Plain Sight: Hunting Volt Typhoon Cyber Actors
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
55mNation-State Moneymule's Hunting Season – APT Attacks Targeting Financial Institutions