Back Securityaffairs.Co

Ghostwriter group resumes attacks on Ukrainian Government targets

Securityaffairs.Co •Pierluigi Paganini • May 15, 2026

ESET uncovered new Ghostwriter (aka FrostyNeighbor) activity targeting Ukrainian government organizations in a campaign active since March 2026. ESET researchers published a new report documenting fresh activity attributed to the APT group FrostyNeighbor, aka Ghostwriter, active since at least March 2026, targeting Ukrainian governmental organizations. The campaign is similar to FrostyNeighbor’s campaigns. The threat […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ghostwriter Group Resumes Targeted Cyber Attacks on Ukrainian Government The Ghostwriter group, also known as FrostyNeighbor, has resumed cyber attacks targeting Ukrainian government organizations as of March 2026. ESET researchers have documented this activity, which involves phishing attacks using geofenced PDF files and the deployment of Cobalt Strike malware. The campaign aims to compromise sensitive governmental systems, continuing a pattern of state-sponsored cyber operations against Ukraine. The specific impact on affected systems has not been detailed, but the ongoing nature of these attacks raises significant concerns for national security. As of May 2026, the campaign remains active, with ongoing efforts to mitigate the threats posed by these attacks. 5 sources 74

Extracted Entities

Ghostwriter group resumes attacks on Ukrainian Government targets

The full story

Extracted Entities

APT Groups (1)

Campaigns (1)

Industries (1)