MEDIUMApt
Global

Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike

·Source: The Hacker News

Updated:

Executive Summary

The Belarus-aligned threat group known as Ghostwriter has been attributed to a fresh set of attacks targeting governmental organizations in Ukraine. Active since at least 2016, Ghostwriter has been linked to both cyber espionage and influence operations targeting neighboring countries, particularly Ukraine. It's also tracked under the monikers FrostyNeighbor, PUSHCHA, Storm-0257, TA445, UAC‑0057

Analysis

The Belarus-aligned threat group known as Ghostwriter has been attributed to a fresh set of attacks targeting governmental organizations in Ukraine. Active since at least 2016, Ghostwriter has been linked to both cyber espionage and influence operations targeting neighboring countries, particularly Ukraine. It's also tracked under the monikers FrostyNeighbor, PUSHCHA, Storm-0257, TA445, UAC‑0057
Source Attribution

Originally published by The Hacker News on May 14, 2026.

Related Threats

MEDIUMApt

Mustang Panda Linked to New Modular FDMTP Backdoor

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/mustang-panda-linked-to-new-modular-fdmtp-backdoor-image_small-10-a-31696.jpg" align=right hspace=4><b>Researchers Say Nation-State Actors Are Evolving Persistence Techniques</b><br>An apparent Chinese nation-state hacking group gussied up its tooling with new modular functionality, say security researchers who observed a cyberesp

Bank Info Security
MEDIUMApt

Mustang Panda Linked to Updated FDMTP Backdoor in Asia-Pacific Espionage Campaign

Mustang Panda campaign deploys updated FDMTP backdoor against Asia-Pacific and Japan networks

Infosecurity Magazine
LOWApt

FlowerStorm phishing gang adopts virtual-machine obfuscation to evade email defenses

A widely active phishing-as-a-service (PhaaS) operation known as FlowerStorm has begun using a browser-based virtual machine to conceal credential theft code, marking what researchers say is an escalation in phishing-kit sophistication that could make attacks harder for traditional email and static-analysis tools to detect. Researchers at Sublime Security said in April that they identified the cam

CSO Online