New Cyberattack Campaign Targets Belarusian Opposition Activists and Ukrainian Military Organizations

A new cyberattack campaign is targeting opposition activists in Belarus as well as Ukrainian military and governmental organizations. This campaign employs Microsoft Excel documents infected with malware to deploy a new variant of PicassoLoader. The group responsible, known as Ghostwriter (or Moonscape), is linked to Belarus and extends a long-standing campaign. The Excel documents are obfuscated using Macropack to hide malicious macros.