Ghostwriter APT Targets Ukrainian Government With Geofenced PDF Phishing and Cobalt Strike

Belarus-linked APT group Ghostwriter (UNC1151/UAC-0057) launched a new campaign targeting Ukrainian government entities using geofenced PDF phishing documents that deploy Cobalt Strike beacons. The campaign uses weaponized documents distributed through phishing emails with Google Drive links.