Ghostwriter — Campaign Analysis & Threat Activity

Threat entity extracted from intelligence sources

Frequency
12
occurrences
First Seen
May 14, 2026
Last Seen
June 5, 2026

Ghostwriter is a threat campaign tracked across 6 threat clusters and 12 intelligence report mentions on ThreatCluster. First observed May 14, 2026; most recent activity June 5, 2026.

Related Threat Clusters

Recent Intelligence Reports

  • Targeted Gmail Phishing Suspicious Account Activity From Unc1151 Ghostwriter May 2026 — resident.ngo · June 5, 2026
  • Hackers Linked to Belarus Target Google Account of Yury Hubarevich — Reform.News · June 5, 2026
  • Belarus — Scworld · May 22, 2026
  • Banks race to patch new cyber vulnerabilities, and other cybersecurity news — Weforum · May 18, 2026
  • Ghostwriter group resumes attacks on Ukrainian Government targets — Securityaffairs.Co · May 15, 2026
  • Belarus — Reform.News · May 14, 2026
  • 'FrostyNeighbor' APT Carefully Targets Govt Orgs in Poland, Ukraine — Darkreading · May 14, 2026
  • Ghostwriter influence activity — www.mandiant.com · May 14, 2026

CVSS v3.1 Breakdown