Researchers are linking an extensive disinformation campaign called ‘Ghostwriter’ to the government of Belarus, which also has associations with Russia’s foreign intelligence organization.
The report came from security researchers’ recent observations on a threat group called UNC1151, that also was identified as the technical support to the Ghostwriter disinformation campaign. The connection of the artefacts from UNC1151’s activities revealed that many of their operators are located from Belarus’ capital city, Minsk. Moreover, the group is likely operating on behalf of the Belarusian government and military. Experts did not exclude the chance that Russia may also have a connection to the disinformation campaign, but there is no supporting evidence to verify the story for now.
It has been four years since the Ghostwriter campaign held a cyber-enabled disinformation campaign that damaged US and NATO connections in Eastern Europe by spreading fake news articles and other disinformation tactics.
Research shows that 22 out of 24 Ghostwriter campaign operations around early last year comprised false narratives about nuclear weapon deployment in Eastern Europe, war crimes by NATO groups, and how NATO helped spread COVID-19.
It was only back in September this year when the German government and the Council of the European Union’s officials have formally recognised Russia to have sponsored the Ghostwriter disinformation campaign after a string of cyberattacks where they concluded to have an effect on the results of Germany’s parliamentary elections.
The researchers, however, highlight that Belarus may be more linked to the disinformation campaign than Russia upon their deeper look at activities and based on other data acquired from UNC1151.
The UNC1151 threat group is revealed to have been launching cyber-espionage for the interests of the Belarus government since 2017. The attacks involved many private and government groups from Germany, Ukraine, Poland, Latvia, and Lithuania.
Meanwhile, another researcher studied the Ghostwriter campaign and UNC1151 and discovered that the operation’s infrastructure is notably larger than experts have thought. About 81 domains were found being used for phishing activities of the Ghostwriter campaign. These phishing campaigns have targeted the Polish government and the French and Ukrainian armies.
Cyber disinformation efforts are getting worse, as observed by experts. They also stressed that the entire world must be alarmed by these activities and not just the presently affected territories like Europe.
