CERT24Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt StrikeLoading data…
CERT24Threat Observatory
Period

Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike

The Belarus-aligned Ghostwriter group has conducted phishing attacks against Ukrainian governmental organizations since March 2026. The attacks use malicious PDF files that can lead to the deployment of PicassoLoader and Cobalt Strike.

← Back to intelligence

Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike

The Belarus-aligned Ghostwriter group has conducted phishing attacks against Ukrainian governmental organizations since March 2026. The attacks use malicious PDF files that can lead to the deployment of PicassoLoader and Cobalt Strike.