UNC1151 Ghostwriter Hackers Target Belarusian Politician in Gmail Phishing Campaign

A well-known hacker group called UNC1151, also widely known as Ghostwriter, has been caught running a targeted phishing campaign against a prominent Belarusian pro-democracy politician.

The group, which has long been tied to the interests of the Belarusian government and, by extension, Russia, sent a carefully crafted fake email to Yury Hubarevich designed to steal his Gmail credentials.

This latest attack is a sharp reminder of how state-aligned threat actors continue to use simple but effective tricks to silence political opposition voices.

UNC1151 first came into the spotlight in 2020 when it broke into legitimate news and media websites to plant fake stories, earning it the widely used name Ghostwriter.

Since then, the group has stayed very active, running spear-phishing campaigns across Eastern Europe with a particular focus on individuals in Poland and Ukraine.

The attack on Hubarevich fits that familiar pattern, though the scale of what researchers uncovered behind it tells a far bigger story.

Researchers at Censys, a leading internet intelligence platform, said in a report shared with Cyber Security News (CSN) that the phishing attempt against Hubarevich was not a standalone hit but part of a wider credential-theft operation targeting both Belarus and Ukraine.

Using certificate and infrastructure pivot techniques, the team traced the attack back to a broader network of phishing domains actively collecting login details from victims across multiple countries.

The attack began with a phishing email written in Russian, warning Hubarevich of suspicious activity on his Google account and urging him to verify his login details immediately.

This is a classic social engineering trick that relies on urgency and the real fear of losing account access.

The link inside the email directed him to a compromised Ukrainian website, which then forwarded him to a fake Google login page built to look completely real and trustworthy.

What made this attack especially dangerous was a background websocket connection that transmitted anything typed on the fake login page directly to the attackers in real time.

This setup allowed them to bypass SMS-based and one-time password multi-factor authentication, meaning even users with two-step verification enabled were still at risk.

The final screen shown to the victim read, in Russian, “Account verification has been initiated successfully. You’ll receive further information within 24 hours.”

UNC1151 Ghostwriter Hackers Target Belarusian Politician

The attackers used a content delivery network called Bunny CDN to hide the real IP addresses behind their phishing pages, making the infrastructure much harder to trace.

However, investigators found that a certificate tied to one of the phishing hostnames had been publicly visible on the IP address 45.194.44.44, hosted in Poland under Datagear.

That one small operational mistake cracked open the door to a far larger infrastructure discovery.

By following that certificate, researchers mapped out several more phishing domains linked to the same IP address, including mail-secure-login.digital and check-account.digital.

These domain names follow a deliberate pattern, using words like “mail,” “account,” “security,” and “verification” to appear legitimate to an unsuspecting user.

Three additional IP addresses running the same web server fingerprint were also identified, each hosting certificates for more fake login pages.

Multinational Credential Theft Operation Exposed

The broader picture that emerged showed the group actively targeting users of at least three popular Ukrainian online portals, including I.UA, bigmir)net, and META.UA.

Phishing pages mimicking each of these platforms were found active and ready to harvest credentials at the time of the investigation.

CERT Polska and ESET, who track this group under the name FrostyNeighbor, have separately documented very similar campaign patterns in recent months.

For individuals in politically sensitive roles, the best defense starts with strong account hygiene and healthy skepticism toward urgent login requests.

Using hardware security keys instead of SMS-based two-factor authentication is far more resistant to real-time phishing interception of this kind.

Any email arriving in regional languages with an account warning should always be verified through official channels before clicking any link inside it.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.