{
	"id": "e7a7d97f-51b6-4dda-a506-d5427e3c090d",
	"created_at": "2026-04-06T00:06:14.199527Z",
	"updated_at": "2026-04-10T13:11:52.679094Z",
	"deleted_at": null,
	"sha1_hash": "b2bbaca5fdb07013e5ec893784921f9c35eaf238",
	"title": "Ghostwriter Influence Campaign Spreads Fabricated Content",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 34802,
	"plain_text": "Ghostwriter Influence Campaign Spreads Fabricated Content\r\nBy Mandiant\r\nPublished: 2020-07-28 · Archived: 2026-04-05 12:40:29 UTC\r\nWritten by: Lee Foster, Sam Riddell, David Mainor, Gabby Roncone\r\nMandiant Threat Intelligence has tied together several information operations that we assess with moderate\r\nconfidence comprise part of a broader influence campaign—ongoing since at least March 2017—aligned with\r\nRussian security interests. The operations have primarily targeted audiences in Lithuania, Latvia, and Poland with\r\nnarratives critical of the North Atlantic Treaty Organization’s (NATO) presence in Eastern Europe, occasionally\r\nleveraging other themes such as anti-U.S. and COVID-19-related narratives as part of this broader anti-NATO\r\nagenda. We have dubbed this campaign “Ghostwriter.”\r\nMany, though not all of the incidents we suspect to be part of the Ghostwriter campaign, appear to have leveraged\r\nwebsite compromises or spoofed email accounts to disseminate fabricated content, including falsified news\r\narticles, quotes, correspondence and other documents designed to appear as coming from military officials and\r\npolitical figures in the target countries.\r\nThis falsified content has been referenced as source material in articles and op-eds authored by at least 14\r\ninauthentic personas posing as locals, journalists and analysts within those countries. These articles and op-eds,\r\nprimarily written in English, have been consistently published to a core set of third-party websites that appear to\r\naccept user-submitted content, most notably OpEdNews.com, BalticWord.com, and the pro-Russian site\r\nTheDuran.com, among others, as well as to suspected Ghostwriter-affiliated blogs.\r\nSome of these incidents and personas have received public attention from researchers, foreign news outlets, or\r\ngovernment entities in Lithuania and Poland, but have not been tied to a broader activity set. Others have received\r\nlittle attention and remain relatively obscure. Mandiant Threat Intelligence has independently discovered several\r\nGhostwriter personas and identified additional incidents involving some of those personas previously exposed.\r\nWe believe the assets and operations discussed in this report are for the first time being collectively tied together\r\nand assessed to comprise part of a larger, concerted and ongoing influence campaign.\r\nRead the report today to learn more.\r\nPosted in\r\nThreat Intelligence\r\nSecurity \u0026 Identity\r\nSource: https://www.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-campaign.html\r\nhttps://www.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-campaign.html\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-campaign.html"
	],
	"report_names": [
		"ghostwriter-influence-campaign.html"
	],
	"threat_actors": [
		{
			"id": "8a33d3ac-14ba-441c-92c1-39975e9e1a73",
			"created_at": "2023-01-06T13:46:39.195689Z",
			"updated_at": "2026-04-10T02:00:03.243054Z",
			"deleted_at": null,
			"main_name": "Ghostwriter",
			"aliases": [
				"UAC-0057",
				"UNC1151",
				"TA445",
				"PUSHCHA",
				"Storm-0257",
				"DEV-0257"
			],
			"source_name": "MISPGALAXY:Ghostwriter",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775433974,
	"ts_updated_at": 1775826712,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b2bbaca5fdb07013e5ec893784921f9c35eaf238.pdf",
		"text": "https://archive.orkl.eu/b2bbaca5fdb07013e5ec893784921f9c35eaf238.txt",
		"img": "https://archive.orkl.eu/b2bbaca5fdb07013e5ec893784921f9c35eaf238.jpg"
	}
}