Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware

Ghostwriter threat actor is targeting Ukrainian government organizations with phishing attacks using Prometheus platform lures.

• •Phishing emails with PDF attachments containing malicious JavaScript files (OYSTERFRESH) are used for initial access to government entities
• •OYSTERBLUES malware is deployed to the Windows Registry to harvest system information and establish command-and-control communication
• •The attack chain includes OYSTERSHUCK decoder and culminates with Cobalt Strike deployment for post-exploitation activities
• •Ukraine's security council reports that Russia is leveraging AI tools like ChatGPT and Gemini to scout targets and embed malicious command generation into malware
• •Related activity shows the Social Design Agency hijacking Bluesky user accounts since 2024 to distribute propaganda content targeting journalists and professors