Hackers from Belarus likely behind cyberattacks on Poland - US experts

A team of hackers with ties to the Belarusian regime, and whose actions were part of a campaign known as Ghostwriter, is likely responsible for the hacking of email accounts used by current and former Polish government officials, a US cybersecurity firm has said.

Mandiant announced its findings at the Cyberwarcon conference and published them in a press release on Tuesday.

In June, Poland accused UNC1151 of attacking over 4,000 accounts of Polish e-mail users. Among the targets were over 100 accounts used by Poland's top officials, ministers and MPs representing a spectrum of political groups. The Polish government blamed Russia for the attack, saying the "Ghostwriter" campaign aimed to destabilize the political situation in the countries of Central Europe.

"Mandiant Threat Intelligence assesses with high confidence that UNC1151 is linked to the Belarusian government," the press release read, adding that the assessment is based on technical and geopolitical indicators.

The US cybersecurity experts suggested that Belarusian regime is also at least partially responsible for the Ghostwriter information and espionage campaign.

The firm said that the operation, originally directed against the presence of NATO soldiers in the countries of the eastern flank, changed its character and targeted mainly the authorities and societies of Belarus's neighbours, and also during the period of last year's presidential elections in Belarus, the Belarusian opposition.

"Promoted narratives have focused on alleging corruption or scandal within the ruling parties in Lithuania and Poland, attempting to create tensions in Polish-Lithuanian relations, and discrediting the Belarusian opposition," Mandiant said.

Mandiant was the first centre to identify a cyber-operation that had been underway since at least 2016 and was originally widely recognised as the work of Russian intelligence.

They said that although Russian participation in UNC1151 and Ghostwriter operation cannot be ruled out, they "have not uncovered direct evidence of Russian government involvement."

Josep Borrell, the head of EU diplomacy, also mentioned Russia's participation in his statement in September.