Ghostwriter APT Group Revives Phishing Campaign Using Ukrainian E‑learning Platform

Why It Matters

Ghostwriter’s renewed activity signals a heightened focus on exploiting trusted domestic services to bypass conventional security controls. By weaponizing a widely‑used e‑learning platform, the group demonstrates an evolving sophistication in social engineering that could inspire copycat campaigns across the region. For Ukraine, the breach threatens the confidentiality of governmental communications and could facilitate broader espionage or disruptive operations. The campaign also highlights the challenges of defending against threat actors that blend legitimate infrastructure (Cloudflare, .icu domains) with custom malware. Effective mitigation now hinges on granular policy controls—such as limiting script execution for standard users—and rapid threat intelligence sharing across public and private sectors.

Key Takeaways

• Ghostwriter (UAC‑0057/UNC1151) launched a phishing campaign against Ukrainian government agencies using the Prometheus e‑learning platform.
• Malicious PDF links deliver a ZIP archive containing OYSTERFRESH JavaScript, which installs OYSTERBLUES and ultimately a Cobalt Strike beacon.
• Infrastructure is hidden behind Cloudflare and primarily uses .icu top‑level domains.
• CERT‑UA advises restricting wscript.exe for regular user accounts to block the JavaScript execution path.
• The campaign has been active since spring 2026 and was publicly disclosed by CERT‑UA this week.

Pulse Analysis

Ghostwriter’s return illustrates a broader trend where APT groups prioritize context‑rich lures over generic spam. By embedding malicious links within a platform that government employees already trust, the group reduces friction and increases click‑through rates. This tactic mirrors recent Russian‑linked operations that weaponized popular Ukrainian services, suggesting a coordinated effort to erode trust in domestic digital ecosystems.

From a defensive standpoint, the campaign underscores the limits of traditional email security solutions that focus on known malicious attachments or URLs. The use of compromised legitimate accounts and benign‑looking PDFs forces organizations to adopt behavior‑based detection and stricter script execution policies. The recommendation to block wscript.exe for non‑administrative users is a low‑cost, high‑impact control that can neutralize a large portion of JavaScript‑driven malware, yet many enterprises have yet to implement it.

Looking ahead, analysts anticipate that Ghostwriter may expand its phishing repertoire to other sectors, such as finance or energy, leveraging similar trusted platforms. The reliance on Cloudflare and .icu domains also hints at a possible shift toward more resilient command‑and‑control architectures that can survive takedown attempts. Ukrainian authorities and their allies must therefore prioritize rapid threat intel dissemination, continuous user awareness training, and granular endpoint hardening to stay ahead of this adaptive threat actor.