# Ghostwriter (Influence Operation) Ghostwriter is a hack-and-forge influence campaign against NATO's eastern flank. It has been active since at least March 2017. Its method is to break into real news websites and politicians' email or social-media accounts, then use that access to publish fabricated articles, quotes and letters under trusted names — for example, fake stories of NATO troops misbehaving in Lithuania, Latvia and Poland. FireEye (now Mandiant) named it in July 2020. The technical intrusion group behind it is tracked as **UNC1151**, and by Ukraine's CERT-UA as **UAC-0057**. ## Who runs it: Russia, Belarus, or both The campaign is a clear case of governments and security firms attributing the same activity differently: - **Mandiant (November 16, 2021):** "high confidence" that UNC1151 is linked to the Belarusian government, and moderate confidence that it is linked to the Belarusian military, with operators likely in Minsk. Mandiant found no direct evidence of Russian involvement, could not rule it out, and saw no technical overlap with known Russian groups. - **Poland (June 22, 2021):** its intelligence services attributed attacks on more than 4,000 Polish email accounts, over 100 of them belonging to officials, to UNC1151 acting "in coordination with Russian intelligence services." - **Germany (September 2021):** the Foreign Office attributed Ghostwriter to "cyber-actors of the Russian state and specifically to the military intelligence service [[GRU]]." - **European Union (September 24, 2021):** the EU's foreign-policy chief said some member states had associated the activity "with the Russian State." The vault's summary: Mandiant attributes it to the Belarusian government, while Germany, Poland and EU member states attribute it to the Russian state. Given the Belarus–Russia relationship under [[Alexander Lukashenko]], the two answers may not contradict each other. ## Evolution After Belarus's disputed August 2020 election, the campaign shifted toward attacking the Polish and Lithuanian governments and the Belarusian opposition. SentinelOne reported in February 2025 a new campaign, prepared in mid-2024 and active November–December 2024, against Ukrainian military and government targets and, for the first time, Belarusian opposition activists. ## Why it matters for the KB Ghostwriter is the hard-access version of what [[Doppelganger]] and [[Operation Overload]] do with look-alikes and logos. Instead of imitating a trusted outlet, it takes the outlet over. Its targets — Poland, the Baltics, NATO's presence there — are the front line of the alliance commitments the American right now argues about. ## See Also - [[Doppelganger]] - [[Operation Overload]] - [[Hybrid Warfare]] - [[Kremlin Disinformation]] - [[Russian Influence]]