Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike

Back Thehackernews

Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike

Thehackernews •[email protected] (The Hacker News) • May 14, 2026

Share: View original

Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points.

Learn how to validate real attack paths and reduce exploitable risk with continuous agentic security validation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ghostwriter Group Resumes Targeted Cyber Attacks on Ukrainian Government The Ghostwriter group, also known as FrostyNeighbor, has resumed cyber attacks targeting Ukrainian government organizations as of March 2026. ESET researchers have documented this activity, which involves phishing attacks using geofenced PDF files and the deployment of Cobalt Strike malware. The campaign aims to compromise sensitive governmental systems, continuing a pattern of state-sponsored cyber operations against Ukraine. The specific impact on affected systems has not been detailed, but the ongoing nature of these attacks raises significant concerns for national security. As of May 2026, the campaign remains active, with ongoing efforts to mitigate the threats posed by these attacks. 5 sources 74

Extracted Entities

Attack Types (1)

Campaigns (1)

Industries (1)

Malware (1)

MITRE ATT&CK (1)

T1566.001 - Spearphishing Attachment