Belarusian hackers attacked the personal Gmail accounts of Polish politicians, public figures, and members of their families.
The national computer emergency response team warned that the Minsk-sponsored group GhostWriter has expanded the scale of its phishing operations and shifted its focus to personal email accounts of high-ranking individuals using Gmail. Previously, these hackers mainly targeted corporate work emails hosted on Polish servers, but since March their main targets have become personal accounts belonging to the political elite, government officials, law enforcement personnel, journalists, and researchers, according to CERT Polska, according to The Record.
In recent months, specialists have observed the creation of new domains with phishing pages almost daily, CERT Polska stated. The Belarusian hackers use these sites to steal logins, passwords, and two-factor authentication codes. After gaining access to Polish politicians’ Gmail accounts, the attackers extract contact lists, confidential documents, and linked online profiles in order to take over social media accounts and identify new victims.
In some cases, the attackers do not know exact email addresses and simply guess names, which results in unrelated people with similar details also being targeted. Attacks on forensic experts and translators have also been recorded.
The GhostWriter group, also known as UNC1151 and Storm-0257, is directly linked to Belarusian security services and has been continuously attacking Poland since the beginning of Russia’s full-scale invasion of Ukraine. In addition to Gmail hacks, the group conducts influence operations and spreads disinformation, aiming to drive a wedge between Poland and Ukraine, the United States, and NATO, as well as to fuel internal social tensions within Poland. The group has also carried out cyberattacks against Ukrainian government agencies and military organizations.
