UnclassifiedIdeologyAdvanced sophistication
GhostWriter
GhostWriter is a Belarus-attributed threat actor group with an ideological motive, tracked by Brandefense. It targets 4 sectors, including Government, and Education and Research, in 12 countries, including France and Germany. It uses 10 MITRE ATT&CK techniques.
Also known as
- Storm-0257
- UNC1151
- FrostyNeighbor
- PUSHCHA
- UAC-0057
- TA445
- Origin
- Belarus
- Techniques
- 10
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2016
- Last seen
- May 14, 2026
- Record updated
Who They Target.
About GhostWriter.
Threat actor exploring alternatives in attack chains, prioritizing continuity over stealthiness, linked to attacks on Poland using Slack for beaconing.
Last updated Sep 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.