Ghostwriter Strikes Again: New Cyber Tactics Target Ukraine and Belarus Opposition

Ghostwriter, a cyber-espionage group linked to the Belarusian government, is back with an Excel-lent new phishing scheme targeting Ukraine and Belarusian opposition. Their weapon of choice? Excel documents packed with malicious macros. Looks like Ghostwriter’s Excel-lent adventure is one spreadsheet you definitely don’t want to open!

Hot Take:

Looks like Ghostwriter is back at it again, this time trading in its pen for some Excel spreadsheets. Who knew that Microsoft Office could become a cyber-espionage toolkit? Maybe next, they’ll use PowerPoint to give a presentation on “How to Hack Your Neighbors” with some jazzy transitions. The world of cybercrime is nothing if not creative!

Key Points:

  • Ghostwriter uses weaponized Excel documents in phishing attacks targeting Ukraine and Belarus.
  • New malware variants, PicassoLoader and a new downloader, are being used in these campaigns.
  • Attackers exploit Excel VBA macros to execute malicious payloads.
  • Advanced obfuscation techniques are employed to avoid detection.
  • Organizations in the region are advised to up their cybersecurity game.

Membership Required

 You must be a member to access this content.

View Membership Levels
Already a member? Log in here