Ghostwriter

Ghostwriter is the clearest documented fusion of network intrusion and information operations run by a single actor.

The pattern that named it: compromise the content management system of a legitimate regional news outlet, publish a fabricated article under the outlet's genuine branding, then amplify it through compromised or fake social media accounts before the publisher notices and removes it. The story circulates as authentic reporting from a real, trusted source. In several documented cases the group also compromised the email and social media accounts of real journalists and defence officials to publish forged statements under their names.

The content is consistently designed to undermine NATO's standing in Poland, Lithuania, and Latvia — fabricated stories of NATO soldiers committing crimes, forged letters announcing troop withdrawals, and false claims of contaminated equipment or planned aggression.

Mandiant assessed with high confidence in 2021 that UNC1151 — the intrusion cluster supporting the operation — is linked to the Belarusian government, and the EU sanctioned Belarusian individuals in connection with the activity. The German government has separately attributed Ghostwriter activity targeting parliamentarians to the operation, and Poland has publicly attributed a series of incidents to Belarusian and Russian services.

The group's technical capability is modest — credential phishing and webmail compromise — but its effect is disproportionate, because the payload is a story rather than a payload.