The Computer Emergency Response Team for Ukraine, CERT-UA, has made a warning for the ongoing hacking activities of the Ghostwriter team as well as some phishing activities. According to the agency, the team is currently attacking Ukraine, Russia, Poland, and Belarusian targets.
Belarusian hacking groups
The team was known as a Belarusian hacking group that has members from the Ministry of Defense of the Belarus government. According to Mandiant, a security company, the attacks are supported by UNC1151, another Belarusian hacking group. The government is also said to be partially responsible.
CERT-UA states that Ghostwriter has attacked the World Association of Belarusians, Belarusian Music Festival, and some other art, science, and news-related organizations. UNC1151 on the other hand is sending phishing e-mails with a message that can be seen below:
« Dear user!
Your contact information or not you are a spam bot. Please, click the link below and verify your contact information. Otherwise, your account will be irretrievably deleted.
Thank you for your understanding.
I.UA Team »
There are also reports that some of the phishing e-mails include messages about evacuating the war area.
With the beginning of the war, the hacking activities between the two countries raised to the top level. Anonymous has declared a cyberwar on Russia and begun disabling government-related websites.