The Belarusian government has been accused of at least “partial responsibility” for Ghostwriter attacks in Europe.
While cybersecurity companies often err on the side of caution when it comes to the attribution of threat groups, Mandiant says that it has “high confidence” that Ghostwriter, also linked to UNC115 activities, is a cybercriminal outfit potentially working on behalf of the country’s government.
Sanctions were placed on Belarus earlier this year after the forced diversion of a commercial plane into Belarus airspace to arrest a passenger, a dissident journalist called Roman Protasevich. Now, in retaliation, the country’s President Alexander Lukashenko has been accused of engineering a migrant crisis to destabilize the EU.
However, it seems that retribution may go further, with the attribution of Ghostwriter to the ruling government.