Analysis and Briefings

9th April 2022

Ghostwriter and UNC1151: How Cyber Espionage Enables Influence Operations

How compromised email and social-media accounts can turn cyber intrusion into a trusted channel for disinformation – and why the threat remains active in 2026.

By Claude Khoury, Chief Operating Officer, NSI Global

ORIGINAL PUBLICATION: 9 April 2022 SUBSTANTIVELY UPDATED: 6 October 2026

In the opening weeks of Russia’s full-scale invasion of Ukraine, Meta reported a spike in attempts by the threat actor commonly tracked as Ghostwriter to compromise Ukrainian military and public figures. The objective was not limited to stealing information. Meta observed attempts to take over legitimate Facebook accounts and use them to publish videos portraying Ukrainian troops as weak or surrendering – content that appeared to come from the real account owners.

That attack chain illustrates why cyber espionage and influence operations should not be treated as separate problems. Credential theft can provide access to private information, but it can also give an operator control over an identity that audiences already trust. A compromised official, journalist, executive or military account can become a distribution channel for false information with built-in credibility.

The activity remains relevant in 2026. CERT Polska says UNC1151/Ghostwriter remains one of the most active advanced persistent threat groups it monitors. In 2025 the group was linked to exploitation of a Roundcube vulnerability for credential theft, and since March 2026 CERT Polska has observed high-intensity phishing campaigns against Gmail users capable of capturing passwords and two-factor authentication codes.

Ghostwriter is therefore best understood not as a one-off social-media disinformation campaign, but as a long-running example of how cyber intrusion, account takeover, espionage and information operations can converge around the same strategic objective.

What Are Ghostwriter and UNC1151?

Ghostwriter is the name Mandiant gave to a cyber-enabled influence campaign first publicly detailed in 2020. The campaign initially focused heavily on narratives critical of NATO and its presence in Eastern Europe, particularly in Lithuania, Latvia and Poland, and later expanded its targeting, themes and techniques.

UNC1151 is the intrusion cluster Mandiant linked to at least some technical components of Ghostwriter. UNC1151 has conducted credential-harvesting, phishing and malware operations against government, military, media and other targets in Eastern Europe. Mandiant assessed with high confidence that UNC1151 is linked to the Belarusian government and with moderate confidence that Belarus is at least partially responsible for the Ghostwriter campaign.

Attribution requires discipline. Mandiant stated that it could not rule out Russian contributions to UNC1151 or Ghostwriter, but had not identified direct evidence proving Russian government involvement in the activity it assessed. Strategic alignment with Russian interests is not the same thing as technical proof of Russian control.

How Cyber Espionage Can Enable an Influence Operation

A conventional cyber-espionage operation seeks access to information: emails, documents, contact lists, credentials, account data or systems. An influence operation seeks to shape perceptions, decisions or behaviour. Ghostwriter demonstrates how the first can enable the second.

CYBER-ENABLED INFLUENCE CHAIN

Phishing or account compromise -> mailbox access -> linked social account takeover -> trusted identity captured -> false or manipulated content published -> audience receives the message from an apparently legitimate source.

The operational advantage is trust. A fabricated account must build credibility. A compromised real account inherits the victim’s name, history, contacts, audience and relationships immediately.

This is why an account takeover should not be treated only as an information-confidentiality incident. Depending on the victim and context, it can also create an integrity problem: the attacker may be able to communicate, publish or instruct others while appearing to be the legitimate account owner.

The 2022 Ukraine Case: From Account Compromise to Surrender Narratives

In February 2022, Meta reported increased Ghostwriter targeting of Ukrainian military personnel and public figures. Meta said Ghostwriter typically used email compromise to gain access to social-media accounts and then posted disinformation as though it came from the legitimate owners.

Meta observed attempts to use compromised accounts to publish videos portraying Ukrainian troops as weak or surrendering, including content claiming to show soldiers emerging from a forest under a white flag. Meta secured accounts it believed had been targeted, alerted users where possible and blocked phishing domains used in the campaign.

Meta’s first-quarter 2022 adversarial-threat reporting later said Ghostwriter attempted to compromise the Facebook accounts of dozens of Ukrainian military personnel and, in a handful of cases, succeeded in posting surrender-themed videos from legitimate accounts before Meta blocked further sharing.

The case is important because the influence effect did not depend on creating a persuasive fake persona. It depended on hijacking a real identity and exploiting the trust already attached to it.

Why a Compromised Real Account Is More Valuable Than a Fake One

A legitimate account can give an influence operator characteristics that are difficult to manufacture:

An established identity and posting history.
Existing followers, colleagues, sources and professional contacts.
Access to private messages and other non-public context.
A reputation that makes unusual content more likely to be noticed and believed.
Connections to other accounts that can become follow-on targets.
The ability to create confusion before the real owner regains control and publicly corrects the record.

For government agencies, defence organisations, media outlets, law firms and businesses, the implication is broader than social-media security. The organisation’s digital identity – email, collaboration platforms, official websites, executive accounts and social channels – forms part of its security boundary.

Information Operations Are More Than “Fake News”

The phrase “fake news” is too narrow to describe cyber-enabled influence operations. A campaign can combine technical intrusion with fabricated or manipulated content, compromised websites, spoofed communications, impersonation, stolen documents and coordinated amplification.

Mandiant documented Ghostwriter activity involving compromised websites, spoofed emails, false personas and compromised legitimate social-media accounts. The value of the cyber component is that it can supply both information and access: stolen material can inform a narrative, while compromised infrastructure can provide the channel through which that narrative is published.

The technical intrusion and the influence effect should therefore be investigated together. Treating the account compromise as one incident and the false content as an unrelated communications problem can obscure the attack chain.

2025: UNC1151 Exploits Roundcube for Credential Theft

In June 2025, CERT Polska reported a UNC1151 campaign against Polish organisations that exploited CVE-2024-42009 in Roundcube webmail. The vulnerability allowed attacker-controlled JavaScript to execute when a crafted email was viewed. CERT Polska said the activity was used to capture user credentials and linked the campaign to UNC1151 with high probability.

Information obtained from one affected organisation indicated that, after gaining access to a mailbox, the attackers examined its contents, downloaded the address book and in some cases used the compromised mailbox to send additional messages.

The importance of that campaign is not the technical detail of one Roundcube vulnerability. It shows continuity in the underlying objective: obtain trusted email access, gather information about the victim and their contacts, and create opportunities for further compromise.

2026: Gmail Phishing and Two-Factor Authentication Theft

CERT Polska reported in June 2026 that UNC1151/Ghostwriter remains one of the most active APT groups it monitors. Since March 2026, the group has conducted high-intensity campaigns targeting Gmail users, particularly in Poland.

The phishing pages imitate legitimate account-security workflows and are designed to capture both passwords and two-factor authentication codes. CERT Polska said compromised mailboxes are searched for sensitive documents, contact lists and linked accounts such as social-media profiles that can then be taken over.

The technique has evolved, but the strategic pattern is familiar: compromise the identity layer first, then use the access for collection, further targeting or account takeover.

Cyber Espionage and Influence Operations Are Related – But Not Identical

Not every espionage intrusion becomes an influence operation, and not every influence campaign depends on hacking. Keeping those concepts separate avoids over-attribution.

Activity	Primary Objective	Typical Evidence
Cyber espionage	Obtain information or persistent access	Credential theft, mailbox access, malware, exfiltration, account logs.
Influence operation	Shape perception or behaviour	False narratives, impersonation, coordinated amplification, manipulated content.
Cyber-enabled influence	Use intrusion-derived access or information to enable influence	Compromised accounts or websites used to publish material under a trusted identity.

Ghostwriter is significant precisely because researchers have documented overlap between these domains. Mandiant assessed that UNC1151 provides technical support to Ghostwriter, while acknowledging that not every component of the influence campaign could be conclusively attributed to UNC1151.

What This Means for Australian Organisations

Ghostwriter is geographically associated with Eastern Europe, but the security lesson is wider. Any organisation whose executives, officials or communications channels carry public trust can face similar consequences from account compromise.

For an Australian government contractor, law firm, critical-infrastructure operator, media organisation or enterprise, a compromised identity can be used to steal information and to create false instructions, fraudulent public statements, fabricated disclosures or reputational damage. The incident can therefore cross cyber security, counterintelligence, crisis communications and evidence preservation at the same time.

The risk is highest where one mailbox or identity account can reset passwords for multiple other systems, where privileged users rely on weak forms of MFA, or where public communications channels can publish material without independent verification.

A Defensive Framework for Cyber-Enabled Influence Risk

Identify critical identities. Map the email, social-media, cloud and collaboration accounts whose compromise could create material operational or reputational harm.
Protect email first. Email is often the recovery channel for other accounts, so privileged mailboxes require stronger authentication, monitoring and recovery controls.
Use phishing-resistant MFA where practical. Security keys, passkeys and other phishing-resistant methods reduce exposure to real-time credential and code theft compared with reusable passwords and one-time codes.
Monitor linked accounts and recovery pathways. Understand which identities can reset or authorise access to other services.
Prepare for malicious publication from legitimate accounts. Incident plans should include rapid verification, account containment and public correction procedures.
Preserve evidence. Authentication logs, mailbox rules, session records, device artefacts and platform notifications may be important for reconstructing what occurred.
Separate containment from attribution. Restore control quickly, but avoid making public attribution claims that exceed the available technical and intelligence evidence.
Integrate cyber and communications response. A compromised account may require both technical containment and a coordinated response to false content already distributed.

Where an account or system has already been compromised, NSI Global’s Digital Forensic Incident Response capability can preserve available evidence, reconstruct activity and identify affected accounts or systems.

For organisations seeking to test whether existing controls can prevent or detect credential theft and account compromise, see NSI Global’s Offensive Cyber Security services. Sensitive communications environments may also require broader Communications Security (COMSEC) controls.

Attribution: What Can Be Said With Confidence?

Attribution should distinguish between observed activity, researcher assessment and government attribution. For Ghostwriter and UNC1151, Mandiant assessed with high confidence that UNC1151 is linked to the Belarusian government and with moderate confidence that Belarus is at least partially responsible for Ghostwriter. Mandiant also said that Russian participation could not be ruled out, but that it had not uncovered direct evidence of Russian government involvement in the activity it assessed.

Later reporting from national authorities and researchers may use different intelligence holdings or attribution language. That does not justify collapsing all Belarusian, Russian-aligned and Russian-state activity into a single actor. For decision-makers, the practical question is often what the evidence supports strongly enough to guide defensive action, not whether every component of a campaign can be assigned to one state with certainty.

Frequently Asked Questions

What Is Ghostwriter?

Ghostwriter is a cyber-enabled influence campaign identified by Mandiant that has targeted audiences and organisations in Eastern Europe with anti-NATO, political and other strategic narratives. Researchers have linked at least some of its technical intrusion activity to UNC1151.

What Is UNC1151?

UNC1151 is a cyber-espionage activity cluster known for credential theft, phishing, malware and account compromise. Mandiant assessed with high confidence that it is linked to the Belarusian government.

Is Ghostwriter Russian?

The attribution is more nuanced. Mandiant assessed that UNC1151 is linked to Belarus and that Belarus is likely at least partially responsible for Ghostwriter. It said Russian contributions could not be ruled out but that direct evidence of Russian government involvement had not been identified in the activity it assessed.

How Can Hacking Support an Influence Operation?

A compromised email, website or social-media account can give an operator access to a trusted identity. False or manipulated content can then be published from an account that audiences already recognise as legitimate.

Is UNC1151 Still Active in 2026?

Yes. CERT Polska reported in June 2026 that UNC1151/Ghostwriter remained one of the most active APT groups it monitors and was conducting high-intensity phishing campaigns targeting Gmail users.

Can Two-Factor Authentication Stop UNC1151 Phishing?

Two-factor authentication improves account security, but some modern phishing campaigns attempt to capture both passwords and one-time authentication codes in real time. Phishing-resistant authentication methods such as security keys or passkeys can provide stronger protection where supported.

What Should an Organisation Do After a Trusted Account Is Compromised?

Secure the account and linked identities, preserve relevant logs and notifications, identify any unauthorised messages or content, determine whether information was accessed, and coordinate technical, legal and communications response. Where evidence may be required, avoid unnecessary changes that could destroy useful artefacts.

Why Ghostwriter Still Matters

The 2022 Ukraine campaign demonstrated a simple but important point: the same compromise that gives an attacker access to private information can also give them access to public trust. A stolen password can become both an espionage tool and an influence tool.

The 2025 Roundcube activity and 2026 Gmail campaigns show that UNC1151 continues to adapt its access methods while retaining a strong focus on identity, mailboxes and linked accounts. Organisations should therefore protect trusted identities as critical assets, not merely user accounts.

The correct defensive question is not only “can an attacker read this account?” It is also “what could an attacker make other people believe or do if they controlled it?”

Organisations dealing with suspected account compromise, cyber espionage or coordinated influence risk can contact NSI Global for a confidential consultation to scope the technical, forensic and intelligence questions requiring assessment.