👻 The Belarus-aligned threat actor known as Ghostwriter, also tracked as UAC-0057 and UNC1151, has been observed targeting Ukrainian government organizations with phishing lures related to Prometheus, a Ukrainian online learning platform.
According to the Computer Emergency Response Team of Ukraine, the campaign has been active since spring 2026 and relies on phishing emails sent from compromised accounts. The goal appears to be initial access, reconnaissance, and delivery of follow-on malware that may ultimately lead to post-exploitation activity using Cobalt Strike.
The campaign highlights a familiar but effective pattern: trusted topics, compromised email accounts, decoy documents, and script-based malware delivery.
How the Phishing Campaign Works
The attack begins with phishing emails sent to Ukrainian government entities. Because the emails are sent from compromised accounts, they may appear more trustworthy than messages from newly created or suspicious addresses.
The emails typically contain a PDF attachment. Inside the PDF is a link that redirects the victim to download a ZIP archive.
That ZIP archive contains a malicious JavaScript file known as OYSTERFRESH.
This layered delivery approach helps attackers avoid immediate detection. Instead of placing the malware directly in the email body or attachment, the victim is guided through a chain:
- Phishing email from a compromised account
- PDF attachment with embedded link
- ZIP archive download
- JavaScript execution
- Payload staging through the Windows Registry
- Follow-on malware execution
Each step reduces suspicion and gives the attacker more chances to bypass basic filtering.
The Malware Chain: OYSTERFRESH, OYSTERBLUES, and OYSTERSHUCK
The campaign uses multiple components with distinct roles.
OYSTERFRESH
OYSTERFRESH is the JavaScript file inside the ZIP archive. Its first job is to display a decoy document to distract the victim and make the activity appear legitimate.
While the user sees the decoy, OYSTERFRESH silently writes an obfuscated and encrypted payload called OYSTERBLUES into the Windows Registry.
Using the registry for payload storage is a common stealth technique. It allows attackers to avoid writing obvious malware files to disk and can make forensic analysis more difficult.
OYSTERBLUES
OYSTERBLUES is designed to collect system information from the infected machine.
The harvested data includes:
- computer name
- user account
- operating system version
- last operating system boot time
- list of running processes
This information helps attackers understand the compromised environment and decide whether the target is worth further exploitation.
The collected data is then sent to a command-and-control server using an HTTP POST request.
OYSTERSHUCK
OYSTERSHUCK is responsible for decoding and launching OYSTERBLUES.
Together, these components create a staged infection chain that begins with a simple phishing lure and ends with system profiling and potential follow-on payload delivery.
Cobalt Strike as the Likely Final Payload
After sending system information to the attacker-controlled server, OYSTERBLUES waits for further responses containing next-stage JavaScript code.
That code is executed using JavaScript’s eval() function, a technique often associated with dynamic execution and obfuscation.
The final payload is assessed to be Cobalt Strike, a legitimate adversary simulation framework that is widely abused by threat actors for post-exploitation operations.
Once deployed, Cobalt Strike can support activities such as:
- command execution
- credential theft
- lateral movement
- persistence
- internal reconnaissance
- payload delivery
- data staging
- remote control of compromised systems
In the context of government targeting, this strongly suggests espionage-focused objectives rather than simple cybercrime.
Why Prometheus-Themed Lures Are Effective
Using a familiar Ukrainian online learning platform as a lure is a smart social engineering choice.
Government employees may reasonably expect links, documents, training materials, or administrative messages connected to education platforms. A message referencing a legitimate service can lower suspicion, especially if it appears to come from a known or compromised sender.
This is why phishing remains effective even in mature environments. The technical payload matters, but the first step is psychological: making the user believe the interaction is normal.
Ghostwriter’s Broader Role in Regional Cyber Operations
Ghostwriter has long been associated with information operations, credential theft, phishing, and cyber activity aligned with Belarusian and Russian geopolitical interests.
The latest campaign fits into a broader pattern of cyber operations targeting Ukraine, where attackers focus on:
- government communications
- intelligence collection
- long-term access
- influence operations
- tracking individuals and organizations
- preparing access for future exploitation
The campaign also comes amid warnings from Ukraine’s National Security and Defense Council about Russia-linked actors using artificial intelligence tools to support reconnaissance, target selection, malware behavior, and influence operations.
AI and Modern Cyber Operations
Ukraine’s National Security and Defense Council has warned that Kremlin-backed groups are using AI tools such as ChatGPT and Gemini to support cyber operations.
The reported uses include:
- scouting targets
- generating malicious commands at runtime
- supporting malware functionality
- improving social engineering
- collecting intelligence
- maintaining long-term access in compromised networks
This does not mean AI replaces human operators. Instead, it can accelerate tasks, improve scale, and help attackers automate parts of reconnaissance, malware development, and influence activity.
For defenders, this means phishing campaigns may become more convincing, malware may become more adaptive, and threat actors may be able to move faster through target environments.
Initial Access Trends Against Ukraine
According to Ukrainian authorities, the main initial access vectors observed in 2025 included:
- social engineering
- exploitation of vulnerabilities
- compromised RDP accounts
- compromised VPN accounts
- supply chain attacks
- unlicensed software containing built-in backdoors
These methods show that attackers are not relying on one path. They combine phishing, exposed services, credential abuse, software compromise, and malware staging to gain access and maintain persistence.
The Ghostwriter campaign is another example of this layered approach.
Defensive Recommendations
CERT-UA specifically recommends restricting the ability of standard users to run wscript.exe.
This is important because Windows Script Host is frequently abused to execute malicious JavaScript and VBScript payloads.
Organizations should consider the following controls:
- restrict
wscript.exeandcscript.exeexecution for standard users - block JavaScript execution from ZIP archives and temporary folders
- inspect PDFs containing external links
- monitor for suspicious registry writes used for payload storage
- detect unusual HTTP POST requests from script interpreters
- review email activity from compromised internal accounts
- enforce MFA for email and remote access
- monitor RDP and VPN logins for unusual behavior
- restrict execution of scripts from user-writable directories
- deploy endpoint detection rules for Cobalt Strike behavior
- patch internet-facing systems quickly
- block or alert on
eval()-style script execution where possible - train users to treat PDF links and ZIP downloads as high risk
For government and public-sector organizations, script execution control should be treated as a priority hardening measure.
What Security Teams Should Monitor
Defenders should look for signs of this type of activity across endpoints, mail systems, and network logs.
Useful detection points include:
- phishing emails with PDF attachments containing external links
- ZIP archives downloaded after opening a PDF
- JavaScript files executed from downloads or temporary folders
wscript.exelaunching suspicious scripts- registry keys containing encoded or encrypted payloads
- unexpected outbound HTTP POST requests
- suspicious process enumeration
- Cobalt Strike indicators
- compromised email accounts sending internal phishing messages
- unusual authentication from RDP or VPN services
Because the campaign uses compromised accounts, email security tools should not rely only on sender reputation. Internal mail flow analysis and behavior-based detection are also important.
Related Influence Operations
The disclosure also comes alongside reporting about a pro-Kremlin propaganda campaign involving hijacked Bluesky accounts.
Real accounts belonging to users such as journalists and academics were reportedly abused to post fake content. The campaign has been linked to the Moscow-based Social Design Agency and the broader Matryoshka influence operation.
This reinforces the overlap between cyber operations and information warfare. In modern conflict environments, attackers may use technical compromise to support espionage, propaganda, disruption, and influence activity at the same time.
Final Thoughts
Ghostwriter’s Prometheus-themed phishing campaign against Ukrainian government organizations shows that social engineering remains one of the most effective entry points for state-aligned cyber operations.
The malware chain is not overly complex, but it is practical: a trusted lure, a PDF link, a ZIP archive, JavaScript execution, registry-based payload staging, system reconnaissance, and likely Cobalt Strike deployment.
For defenders, the lesson is clear. Reducing the attack surface means more than blocking known malware. It requires script execution controls, strong email monitoring, compromised account detection, endpoint visibility, and rapid response to suspicious activity.
In the current threat environment, especially for Ukraine and allied public-sector organizations, even routine-looking training or document links must be treated with caution.
