We are releasing reporting on Ghostwriter, IO activity focused on Poland, Lithuania, and Latvia, which leverages false narratives and fabricated content often planted on compromised media sites. The activity is consistent with Russian interests. 1/x https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/Ghostwriter-Influence-Campaign.pdf

Ghostwriter began as early as 2017 and is still going strong, pushing Anti-NATO sentiment on the frontiers of the alliance. NATO soldiers hosted in these countries are portrayed as carjackers and blamed for desecrating cemetaries. Now they are portrayed as COVID-19 carriers. 2/x

Quotes, images, documents are fabricated to provide bona fides to Ghostwriter narratives in a manner similar to Secondary Infektion, though we have not found a link. For instance, a letter from the Secretary General of NATO claimed NATO was leaving Lithuania due to COVID. 3/x

One means of disseminating these narratives has been the compromise of media websites. Stories are being planted on sites to legitimize them. Posted links to another site or emails bring viewers. We are still investigating these compromises and what capability they entail. 4/x

Ghostwriter is regionally focused IO, designed to undermine the support of NATO hosts, but I am wary of these tactics, especially given the election. The first time I saw an APT28 IO operation was in Poland, in response to NATO exercises. This is our opportunity to learn. 5/x

Congrats to @LeeFosterIntel @RiddellSam and the rest of our amazing IO team who consistently turn up amazing threats! 6/x

History repeats itself. Ghostwriter ops accusing German soldiers of defiling a Jewish cemetery resemble the Soviet active measures in W. Germany involving anti-Semitic graffiti. COVID-19 themed narratives resemble several ops that blamed the US for diseases like AIDS. @RidT 7/x