New Ghostwriter Campaign Targets Belarusian Opposition Activists and Ukrainian Government Entities

A new Ghostwriter campaign utilizing a variant of PicassoLoader is targeting opposition activists in Belarus and Ukrainian military and government organizations. SentinelLABS has observed this active campaign since late 2024, where malicious actors have used compromised Microsoft documents. The targets include Belarusian activists and Ukrainian entities, highlighting a persistent and sophisticated threat.