Google’s threat analysis team said that Belarus has targeted Ukrainian and Polish officials with phishing attacks amid Russia’s invasion of Ukraine.
In a blog post on Tuesday, Google’s Threat Analysis Group (TAG) said Ghostwriter, a Belarusian hacking group, has conducted phishing campaigns targeting Polish and Ukrainian government and military organizations in the past week. The campaigns aimed to get officials’ credentials.
TAG added that Ghostwriter has also targeted individuals using several Ukrainian, Russian and Polish email providers.
The threat analysis team also said attack group Fancy Bear, which it identified as being affiliated with Russia’s military intelligence agency had conducted several large phishing campaigns over the past two weeks targeting users of ukr.net, a Ukrainian media company. The phishing emails were sent from compromised accounts and led to credential phishing pages.
“Online security is extremely important for people in Ukraine and the surrounding region right now. Government agencies, independent newspapers and public service providers need it to function and individuals need to communicate safely,” TAG said in the post. “Google’s Threat Analysis Group (TAG) has been working around the clock, focusing on the safety and security of our users and the platforms that help them access and share important information.”
“We’ll continue to take action, identify bad actors and share relevant information with others across industry and governments, with the goal of bringing awareness to these issues, protecting users and preventing future attacks,” it continued. “And while we are actively monitoring activity related to Ukraine and Russia, we continue to be just as vigilant in relation to other threat actors globally, to ensure that they do not take advantage of everyone’s focus on this region.”
This comes more than a week into Russia’s invasion of Ukraine. Since the assault began, the U.S. and its allies have leveled multiple waves of sanctions against Moscow.
They have also imposed sanctions targeting a number of Belarusian individuals and entities in response to Minsk allowing Russia to use the country as a staging ground for the invasion.