‘Ghostwriter’ seems like a pure Russian operation, except for one

[ad_1]
At least four years, hacking and misinformation the well-known group has Ghostwriter It has hit Eastern European and Baltic countries. Considering his methods — and messages against NATO and the US — he has been widely believed to be a Ghostwriter. Another Kremlin-led campaign. The European Union too declare at the end of September some member states “linked” the Ghostwriter to the “Russian state”. As you can see, this is not entirely correct. According to Mandiant threat intelligence company, Ghostwriter’s hackers work for Belarus.
First, he looked closely at Mandiant Ghostwriter July 2020. The group was then, in particular, for creating and distributing fake news as well as hacking real news sites to publish misleading content. By April 2021, Mandiant had blamed Ghostwriter for a wider range of activities, including operations to jeopardize the social media accounts of government officials, including misinformation and efforts aimed at politicians. hacking and filtering operations. The group has long focused on weakening NATO’s role in Eastern Europe, and has increasingly focused on sparking political divisions or instability in Poland, Ukraine, Lithuania, Latvia and Germany.
At a Cyberwarcon conference in Washington on Tuesday, analysts Ben Read and Gabby Roncone Mandiant are presenting evidence of Ghostwriter’s ties to Belarus.
“The activity of stealing credentials for information operations against Eastern Europe and NATO was in line with what we had seen Russia do in the past,” Read told WIRED before the conference. Despite these well-known tactics, techniques and procedures, Mandiant did not make any assignments to Moscow at the time because they did not see a specific digital link.
After the controversial elections in Belarus in August 2020, longtime President Alexander Lukashenko retained power as opposition leader Sviatlana Tsikhanouskaya actually won among the accusations. The US denounced the elections and many Belarusian residents, including Poland, made it clear that they support the Belarusian opposition. During this time, Mandiant saw a marked change in Ghostwriter’s campaigns.
“We saw a shift in the focus on specific issues in Belarus: Belarusian dissidents, Belarusian media, things that seem to be in favor of the Belarusian government,” Read said. “And then we also came across technical details that make us think the operators are located in Minsk and technical details that suggest others about the Belarusian army. We are sure that Ghostwriter now has a connection to Belarus.”
Shane Huntley, who leads Google’s Threat Analysis Group, says the Mandiant research is consistent with the findings of the TAG. “Their report matches what we saw,” he told WIRED.
As the group’s activities became more and more of a Belarusian agenda in the summer, Mandiant was working to shed light on who really was behind the campaigns. Of last year’s elections, 19 of Ghostwriter’s disinformation operations 16 focused on stories that the Lithuanian and Polish governments, neighbors of Belarus, underestimate. Two were negatively targeted by NATO and one criticized the EU.
A Ghostwriter operation centered in Poland and Lithuania prompted a false narrative in August accusing migrants of committing crimes. Tensions between Poland and Belarus have risen sharply in recent weeks as a border point. Other recent operations have involved accidents at Lithuania’s nuclear power plants, perhaps because Lithuania has long opposed the presence of the Belarus Astravyets nuclear power plant near its border. Belarusian state television has received and repeated Ghostwriter misinformation stories, although it is not clear whether this is the result of specific coordination or just part of a general opinion of pro-Belarusian government propaganda. Read also noted that Ghostwriter has not paid attention to Estonia, the only Baltic state that does not border Belarus.
[ad_2]
Source link