Taking a closer look at UNC1151. [Research Saturday]

Senior Threat Intelligence Researcher Matt Stafford from Prevailion discusses their work on "Diving Deep into UNC1151’s Infrastructure: Ghostwriter and beyond." Prevailion’s Adversarial Counterintelligence Team (PACT) used advanced techniques to uncover previously unknown domains associated with UNC1151 and the "Ghostwriter" influence campaign. UNC1151 is likely a state-backed threat actor targeting numerous European countries with operations displaying messaging aligned with Russia's security interests. PACT identified 81 additional unreported domains clustered with the activity detailed in previous reports. They also found that UNC1151 targeted additional European entities outside of the Baltics, Poland, Ukraine, and Germany, with no previous public reporting. The research provides insight into the ongoing and far-reaching influence campaign.