{"id":45485,"date":"2022-02-28T14:01:00","date_gmt":"2022-02-28T14:01:00","guid":{"rendered":"http:\/\/d4c1a18a-d67a-4835-bc1e-0887a3623b5e"},"modified":"2022-02-28T14:01:00","modified_gmt":"2022-02-28T14:01:00","slug":"ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/","title":{"rendered":"Ukraine security agencies warn of Ghostwriter threat activity, phishing campaigns"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/www.zdnet.com\/a\/img\/resize\/8f786d318672a408c41fc69b083c60f3d9df00fe\/2022\/01\/17\/e0e7d48d-443e-4c48-be8d-bf0c83859c7c\/phishing.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\" class=\"ff-og-image-inserted\"><\/div>\n<p>The Computer Emergency Response Team for Ukraine (CERT-UA) has warned of ongoing phishing and Ghostwriter activities attacking organizations in the country.&nbsp;<\/p>\n<div class=\"relatedContent alignRight\">\n<h3 class=\"heading\"> <span class=\"int\">Ukraine Crisis<\/span> <\/h3>\n<\/p><\/div>\n<p>On February 26, <a href=\"https:\/\/www.facebook.com\/UACERT\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">CERT-UA<\/a> said it continues to track the movements of UNC1151\/Ghostwriter, which is currently attacking targets in Ukraine, Poland, Belarus, and Russia.&nbsp;<\/p>\n<p>Ghostwriter is believed to be of Belarusian origin. According to the security agency, its members are officers of the Ministry of Defence of the Republic of Belarus.&nbsp; <\/p>\n<p>Cybersecurity firm Mandiant has been <a href=\"https:\/\/www.mandiant.com\/resources\/unc1151-linked-to-belarus-government\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">tracking campaigns<\/a> supported by UNC1151. In particular, the company says that &#8220;technical support&#8221; is provided to Ghostwriter campaigns and the Belarus government has been accused of being at least &#8220;<a href=\"https:\/\/www.zdnet.com\/article\/belarus-government-accused-of-partial-responsibility-for-ghostwriter-hacking\/\" target=\"_blank\" rel=\"noopener\">partially responsible<\/a>&#8221; for the activities of these cyberattackers.&nbsp; <\/p>\n<p>The <a href=\"https:\/\/www.consilium.europa.eu\/en\/press\/press-releases\/2021\/09\/24\/declaration-by-the-high-representative-on-behalf-of-the-european-union-on-respect-for-the-eu-s-democratic-processes\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">European Council<\/a> has previously accused Russia of having a part to play in Ghostwriter campaigns.&nbsp; <\/p>\n<p>Ghostwriter is said to align with Belarus state interests. Past activities have included promoting anti-NATO material through misinformation networks, spoofing, and website hijacking, as well as targeting Belarusian media outlets and individuals prior to the 2020 election.&nbsp; <\/p>\n<p>&#8220;Ghostwriter narratives, particularly those critical of neighboring governments, have been featured on Belarusian state television as fact,&#8221; Mandiant says.&nbsp; <\/p>\n<p>According to CERT-UA, Ghostwriter cyberattacks have been recorded against the World Association of Belarusians, Belarusian Music Festival, literature and arts magazine Dziejaslou, Belarusian newspaper Sovetskaya Belorussiya, employees of the National Academy of Sciences of Belarus, and the Voice of Motherland newspaper.&nbsp; <\/p>\n<p>In addition, the agency warns that passport[.]command-email.online is an active phishing domain being used by the threat group. <\/p>\n<p>CERT-UA has been publishing frequent threat intelligence since the start of the Russia-Ukraine conflict. CERT-UA has also warned of mass phishing emails being sent by UNC1151 to &#8220;Ukrainian military personnel and related individuals&#8221; using email accounts with &#8216;i.ua&#8217; and &#8216;meta.ua&#8217; addresses.&nbsp; <\/p>\n<p>A sample phishing message is below: <\/p>\n<blockquote readability=\"10\">\n<p>&#8220;Dear user! Your contact information or not you are a spam bot. Please, click the link below and verify your contact information. Otherwise, your account will be irretrievably deleted. Thank you for your understanding. Regards, I.UA Team.&#8221; <\/p>\n<\/blockquote>\n<p>On Monday, the National Security and Defense Council of Ukraine (NSDC\/RNBO) also reported calls and <a href=\"https:\/\/www.facebook.com\/photo\/?fbid=264813735829770&amp;set=a.234693595508451\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">phishing attempts<\/a>&nbsp;made to obtain information from targets by pretending to be the post office of the Security Service of Ukraine (SBU).&nbsp; <\/p>\n<p>The Cyber Police Department of the National Police of Ukraine <a href=\"https:\/\/twitter.com\/CyberpoliceUA\/status\/1498282680181563397\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">reports<\/a> that fake phishing emails are also being sent that are masked as evacuation notices.&nbsp;<\/p>\n<p>In related news, hacktivist collective <a href=\"https:\/\/www.zdnet.com\/article\/anonymous-hacktivists-ransomware-groups-get-involved-in-ukraine-russia-conflict\/\" target=\"_blank\" rel=\"noopener\">Anonymous<\/a> says it has become involved in the conflict, claiming that it is responsible for the defacement of Russian government websites and a takedown of the state news outlet RT. RT and other state-funded media organizations have since been <a href=\"https:\/\/www.reuters.com\/technology\/youtube-blocks-rt-other-russian-channels-generating-revenue-2022-02-26\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">banned<\/a> from generating revenue through ads by Google&#8217;s search and YouTube units.&nbsp; <\/p>\n<p>On February 28, the TASS Russian news outlet appeared to suffer from a cyberattack and visitors were temporarily unable to access the website. Anonymous, or someone claiming to be part of the collective, claimed responsibility.&nbsp; <\/p>\n<p>Meta, formerly known as Facebook, has <a href=\"https:\/\/www.zdnet.com\/article\/meta-blocks-russian-state-media-accounts-in-ukraine\/\" target=\"_blank\" rel=\"noopener\">restricted access<\/a> to some accounts owned by Russian state media organizations. Meta&#8217;s Head of Security Policy Nathaniel Gleicher and Director of Threat Disruption David Agranovich said <a href=\"https:\/\/about.fb.com\/news\/2022\/02\/security-updates-ukraine\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">on February 27<\/a> that a network operated by people in Russia &#8212; and Ukraine &#8212; was targeting Ukraine with fake news and propaganda.&nbsp; <\/p>\n<p>According to the firm, there has also been &#8220;increased targeting&#8221; of the Ukrainian military and public figures by Ghostwriter.&nbsp; <\/p>\n<h3> Previous and related coverage <\/h3>\n<hr>\n<p><strong>Have a tip?<\/strong> Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0<\/p>\n<hr>\n<p> READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/ukraine-security-agency-warns-of-ghostwriter-threat-group-activity-phishing-campaigns\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>CERT-UA warns of misinformation, phishing, and active assaults against Ukrainian organizations.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-45485","post","type-post","status-publish","format-standard","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Ukraine security agencies warn of Ghostwriter threat activity, phishing campaigns 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ukraine security agencies warn of Ghostwriter threat activity, phishing campaigns 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-02-28T14:01:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.zdnet.com\/a\/img\/resize\/8f786d318672a408c41fc69b083c60f3d9df00fe\/2022\/01\/17\/e0e7d48d-443e-4c48-be8d-bf0c83859c7c\/phishing.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Ukraine security agencies warn of Ghostwriter threat activity, phishing campaigns\",\"datePublished\":\"2022-02-28T14:01:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\\\/\"},\"wordCount\":612,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/8f786d318672a408c41fc69b083c60f3d9df00fe\\\/2022\\\/01\\\/17\\\/e0e7d48d-443e-4c48-be8d-bf0c83859c7c\\\/phishing.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\\\/\",\"name\":\"Ukraine security agencies warn of Ghostwriter threat activity, phishing campaigns 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/8f786d318672a408c41fc69b083c60f3d9df00fe\\\/2022\\\/01\\\/17\\\/e0e7d48d-443e-4c48-be8d-bf0c83859c7c\\\/phishing.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\",\"datePublished\":\"2022-02-28T14:01:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/8f786d318672a408c41fc69b083c60f3d9df00fe\\\/2022\\\/01\\\/17\\\/e0e7d48d-443e-4c48-be8d-bf0c83859c7c\\\/phishing.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\",\"contentUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/8f786d318672a408c41fc69b083c60f3d9df00fe\\\/2022\\\/01\\\/17\\\/e0e7d48d-443e-4c48-be8d-bf0c83859c7c\\\/phishing.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ukraine security agencies warn of Ghostwriter threat activity, phishing campaigns\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ukraine security agencies warn of Ghostwriter threat activity, phishing campaigns 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/","og_locale":"en_US","og_type":"article","og_title":"Ukraine security agencies warn of Ghostwriter threat activity, phishing campaigns 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-02-28T14:01:00+00:00","og_image":[{"url":"https:\/\/www.zdnet.com\/a\/img\/resize\/8f786d318672a408c41fc69b083c60f3d9df00fe\/2022\/01\/17\/e0e7d48d-443e-4c48-be8d-bf0c83859c7c\/phishing.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Ukraine security agencies warn of Ghostwriter threat activity, phishing campaigns","datePublished":"2022-02-28T14:01:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/"},"wordCount":612,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/8f786d318672a408c41fc69b083c60f3d9df00fe\/2022\/01\/17\/e0e7d48d-443e-4c48-be8d-bf0c83859c7c\/phishing.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/","url":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/","name":"Ukraine security agencies warn of Ghostwriter threat activity, phishing campaigns 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/8f786d318672a408c41fc69b083c60f3d9df00fe\/2022\/01\/17\/e0e7d48d-443e-4c48-be8d-bf0c83859c7c\/phishing.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","datePublished":"2022-02-28T14:01:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/#primaryimage","url":"https:\/\/www.zdnet.com\/a\/img\/resize\/8f786d318672a408c41fc69b083c60f3d9df00fe\/2022\/01\/17\/e0e7d48d-443e-4c48-be8d-bf0c83859c7c\/phishing.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","contentUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/8f786d318672a408c41fc69b083c60f3d9df00fe\/2022\/01\/17\/e0e7d48d-443e-4c48-be8d-bf0c83859c7c\/phishing.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/ukraine-security-agencies-warn-of-ghostwriter-threat-activity-phishing-campaigns\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Ukraine security agencies warn of Ghostwriter threat activity, phishing campaigns"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/45485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=45485"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/45485\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=45485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=45485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=45485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}