Do Son A suspected UNC1151 phishing campaign targets Belarusian politicians and Ukrainian portals to steal credentials using deceptive login pages.
Ghostwriter
The UNC1151 Gmail phishing campaign by Ghostwriter steals passwords and 2FA codes from Polish targets via fake Google login pages. Stay alert.
A new report from HarfangLab details two recent UAC-0057 (Ghostwriter) campaigns targeting Ukraine and Poland with malicious archives and multi-stage implants.
UNC1151 employed DLL loaders that downloaded an encrypted JPG file, which was then decrypted to deploy a final payload executable.