Ghostwriter Deploys Prometheus-Themed Phishing Campaign Against Ukrainian Government

Belarus-aligned threat actor Ghostwriter (UAC-0057, UNC1151) is conducting an active phishing campaign against Ukrainian government organizations using lures mimicking Prometheus, Ukraine's official online learning platform. Ukraine's Computer Emergency Response Team (CERT-UA) reports the operation has been running since spring 2026, exploiting compromised government email accounts to distribute multi-stage JavaScript malware that ultimately delivers Cobalt Strike.

Attack Chain Analysis

The attack begins with phishing emails sent from compromised government accounts, lending credibility to the malicious messages. Each email contains a PDF attachment with an embedded link. When clicked, victims download a ZIP archive containing a JavaScript file designated OYSTERFRESH by CERT-UA.

OYSTERFRESH initiates a sophisticated three-stage deployment process. Upon execution, it displays a decoy document to maintain the illusion of legitimacy while performing two critical background operations: writing an obfuscated, encrypted payload called OYSTERBLUES to the Windows Registry, and downloading OYSTERSHUCK, a decoder component responsible for extracting and executing OYSTERBLUES.

Reconnaissance Capabilities

OYSTERBLUES functions as an information-gathering tool, harvesting extensive system telemetry including computer name, user account details, OS version, last boot time, and enumeration of running processes. This data is exfiltrated via HTTP POST requests to attacker-controlled command-and-control infrastructure.

The malware then waits for C2 responses containing next-stage JavaScript code, which is executed dynamically using the eval() function. This architecture allows operators to customize follow-on activities based on the compromised environment, providing operational flexibility and complicating detection efforts.

Final Payload: Cobalt Strike Deployment

CERT-UA assesses the final payload is Cobalt Strike, the widely-abused adversary simulation framework that has become standard toolkit for nation-state actors. Cobalt Strike provides comprehensive post-exploitation capabilities including credential harvesting, lateral movement, privilege escalation, and persistent access—essential components for intelligence collection and long-term network compromise.

Broader Russian Cyber Operations Context

This Ghostwriter campaign aligns with broader trends documented by Ukraine's National Security and Defense Council regarding Russian cyber operations. The Council revealed Russian actors are now integrating AI tools including OpenAI ChatGPT and Google Gemini for target reconnaissance and embedding AI into malware to generate malicious commands at runtime.

According to the Council, primary attack vectors in 2025 included social engineering, vulnerability exploitation, compromised RDP and VPN accounts, supply chain attacks, and unlicensed software containing pre-installed backdoors. These campaigns focus on stealing sensitive information, intercepting communications, and tracking target locations while maintaining long-term presence for follow-on exploitation and influence operations.

Mitigation Recommendations

CERT-UA recommends restricting wscript.exe execution for standard user accounts to reduce attack surface. Organizations should implement application whitelisting policies that prevent unauthorized script execution, particularly for JavaScript and VBScript files originating from email attachments or downloads.

• Block JavaScript execution from email attachments and compressed archives through email gateway policies
• Implement Group Policy Objects to restrict wscript.exe and cscript.exe execution for non-administrative accounts
• Monitor Windows Registry modifications, particularly in user-writable locations used for persistence
• Deploy endpoint detection rules for obfuscated JavaScript patterns and eval() function usage
• Scrutinize emails referencing Prometheus or other government platforms, especially those with PDF attachments containing external links
• Enable Cobalt Strike behavioral detection signatures on EDR platforms

Strategic Assessment

Ghostwriter's continued operations against Ukrainian government infrastructure demonstrate persistent targeting by Belarus-aligned actors supporting Russian strategic objectives. The use of legitimate platform lures like Prometheus shows operational sophistication in social engineering, exploiting trusted government systems to increase success rates.

The integration of AI tools by Russian actors, combined with multi-stage malware deployment techniques and long-term persistence objectives, indicates these operations are designed for sustained intelligence collection rather than disruptive attacks. Organizations in Ukraine and allied nations should assume active compromise attempts and prioritize detection of early-stage reconnaissance activities before full network compromise occurs.

The parallel execution of technical intrusion campaigns alongside information operations like the Bluesky account hijacking campaign reveals coordinated hybrid warfare tactics. Defenders must address both technical security controls and information integrity measures to counter these multi-domain threats effectively.