An information and hacking campaign with links to a foreign state has potentially had a "significant cumulative impact" over many years, according to a report from Cardiff University.
The findings, from the Security, Crime and Intelligence Innovation Institute, provide the most comprehensive picture to date of the activities of the so-called Ghostwriter campaign.
Tracking its evolving activities via open-source data, the report demonstrates how it has impersonated multiple government officials, NATO representatives and journalists across Europe. According to the team's analysis, it has impacted thousands of email users, hacked dozens of social media accounts and media websites and published hundreds of false blogposts.
The integration of cyber-attacks with information manipulation has become more prominent following Russia's invasion of Ukraine. Most recently, it has been engaging in cyber-attacks against Ukrainian government websites, targeting Ukrainian military and public figures on Meta's platforms, and credential phishing on Google.
The report's analysis also covers incidents in Germany, Poland and Lithuania, which have already been publicised and linked to Ghostwriter by cyberfirm Mandiant. There is widespread consensus among Western officials that the campaign is supported by either Russia, Belarus, or both.
Lead author Anneli Ahonen said: "Ghostwriter's activities have triggered multiple yet separate responses from governments, social media platforms, media and private cyber firms. These have focused on strategic communications to counter false narratives, public but partial attribution, improvements in cyber security, and most recently the disruption of parts of Ghostwriter's activity on Facebook and Google.
"But there is no one organisation with an overarching view of the scale of its activities – and so the seriousness of the threat has been poorly understood. Ghostwriter has been able to diversify its methods, targets and the countries it is focusing upon. This has potentially had a significant cumulative impact and effect, given how its various activities have persisted over several years, across multiple social media platforms."
