Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike

Ghostwriter and threat groups conduct coordinated cyber operations across Eastern Europe targeting governments and military organizations.

• •Ghostwriter uses geofenced PDF phishing with JavaScript PicassoLoader downloader targeting Ukrainian government entities
• •Host fingerprinting occurs every 10 minutes before Cobalt Strike Beacon deployment after server-side validation
• •Gamaredon targets Ukrainian institutions with GammaDrop and GammaLoad malware exploiting CVE-2025-8088
• •BO Team attacks Russian organizations with BrockenDoor, ZeronetKit, and undocumented ZeroSSH Go-based backdoor
• •Hive0117 steals over 14 million rubles from Russian companies through phishing and fraudulent transfer schemes

This summary was automatically generated by AI based on the original article and may not be fully accurate.