Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware
Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware
Ravie LakshmananMay 22, 2026Malware / Artificial Intelligence
The Belarus-aligned threat actor known as Ghostwriter (aka UAC-0057 and UNC1151) has been observed using lures related to Prometheus, a Ukrainian online learning platform, to target government organizations in the country.
The activity, per the Computer Emergency Response Team of Ukraine (CERT-UA), involves sending phishing emails to government entities using compromised accounts. It's been active since the spring of 2026.
"Typically, the email contains a PDF attachment with a link that, when clicked, leads to the download of a ZIP archive containing a JavaScript file," the agency said in a Thursday report.
The JavaScript file, dubbed OYSTERFRESH, is designed to display a decoy document as a distraction mechanism, while stealthily writing an obfuscated and encrypted payload called OYSTERBLUES to the Windows Registry, as well as downloading and launching OYSTERSHUCK, which is responsible for decoding OYSTERBLUES.
OYSTERBLUES is equipped to harvest a wide range of system information, including computer name, user account, OS version, time of the last OS boot, and a list of running processes. The collected data is sent to a command-and-control (C2) server over an HTTP POST request.
It then awaits further responses containing next-stage JavaScript code, which is executed using the eval() function. The final payload is assessed to be Cobalt Strike, an adversary simulation framework that's widely abused for post-exploitation activities.
"To reduce the likelihood of this cyber threat being exploited, it is advisable to apply known basic approaches to reducing the attack surface, specifically by restricting the ability to run wscript.exe for standard user accounts," CERT-UA said.
The disclosure comes as Ukraine's National Security and Defense Council revealed Russia's use of artificial intelligence (AI) tools like OpenAI ChatGPT and Google Gemini to scout targets and embed the technology into malware to generate malicious commands at runtime, while calling out Kremlin-backed hacking groups for carry out cyber attacks focused on obtaining intelligence and ensuring a long-term presence in compromised networks for follow-on exploitation, including to support influence operations.
"The main vectors of initial penetration in 2025 were social engineering, exploitation of vulnerabilities, use of compromised RDP and VPN accounts, attacks on supply chains, and the use of unlicensed software that already contains built-in backdoors at the installation stage," the Council said. "Attackers focused on stealing sensitive information, intercepting communications, and tracking the location of targets."
In a related development, details have emerged about a pro-Kremlin propaganda campaign that hijacked real Bluesky users' accounts to post fake content since 2024. Hijacked accounts included journalists and professors. The activity has been attributed to a Moscow-based company called Social Design Agency, which is linked to a campaign known as Matryoshka. In some of these cases, Bluesky has taken the step of suspending the accounts until the owners initiate a reset.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
SHARE
Tweet Share Share Share
SHARE artificial intelligence, CERT-UA, Cobalt Strike, cybersecurity, Malware, Phishing, Social Engineering, Ukraine
⚡ Top Stories This Week
Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software
Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows
ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories
Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros
GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension
GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos
Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit
DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws
MiniPlasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems
NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE
Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective
The New Phishing Click: How OAuth Consent Bypasses MFA
Developer Workstations Are Now Part of the Software Supply Chain
⭐ Featured Resources
Claim ANY.RUN Anniversary Offer for Faster Malware Analysis
[Guide] Learn to Detect AI Typosquatting Risks in Your Domain
[Guide] Get Key Identity Security Insights From 2026 Snapshot
Discover How to Navigate the Era of Constant Cyber Exposure
Cybersecurity Webinars
With HD Moore (Creator of Metasploit) Learn How to Detect Threats Beyond Zero Day Attacks Learn practical strategies to detect and defend against cyber threats beyond zero-day vulnerabilities. Register
Tired of False Positives? Validate Automated Pentesting Results Before Acting Learn how to validate automated pentesting results for accurate security decisions. Register
⚡ Latest News
Cybersecurity Resources
AI Is Reshaping Every Attack Surface. Train for What's NextSANSFIRE 2026 in D.C. brings 50+ courses, AI-focused sessions, and NetWars. July 13–18. Save $500. Your VPN is Helping Attackers Move as Fast as AIAI collapsed human response window and turned remote access into fastest path to breach. Earn a Master's in Cybersecurity Risk ManagementLead the future of cybersecurity risk management with an online Master’s from Georgetown.
Expert Insights Articles Videos
You Can't Patch Your Way Out of This One
May 25, 2026 Read ➝
How to Test Ransomware Recovery Without Reinfecting Your Environment
May 25, 2026 Read ➝
The Scam Before the Game: CTM360 Reveals Threats Targeting FIFA World Cup 2026 Fans
May 25, 2026 Read ➝
7 Signs Your Organization Is Vulnerable to Business Email Compromise
May 18, 2026 Read ➝
Get the Latest News in Your Inbox Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free.