Thread by @ericgeller

New: The Belarusian government is behind a wide-ranging campaign of cyberattacks on its Eastern European neighbors, @Mandiant says. subscriber.politicopro.com/article/2021/1…

Attacks targeted Ukraine, Lithuania, Latvia, Poland, and Germany, as well as Belarusian journalists and dissidents.

In research presented at @CYBERWARCON, Mandiant said it's attributing these attacks to Belarus based on technical evidence and the fact that the targets are "most consistent with Belarusian interests."

Some Belarusians targeted before disputed 2020 election were later arrested.

Mandiant said it had “sensitively sourced technical evidence” that the operation was based in Minsk, as well as “separate technical evidence” specifically linking the Belarusian military to the campaign.

These cyberattacks involved fake websites imitating popular domains, including those of major U.S. tech companies, Eastern European governments, and regional email services.

The fake sites asked for people's login credentials.

Hackers also used proprietary malware.

At first glance, these attacks might look like they're coming from Russia. But Mandiant said there was no technical overlap between the operation and known Russian groups.

The findings underscore how more authoritarian govts are following Russia's lead in using cyberattacks.

In its report, Mandiant also said it had moderate confidence that Belarus is behind the "Ghostwriter" information operations campaign that has sought to discredit and undermine NATO in Eastern Europe.

(see also: mandiant.com/resources/espi…)

Ghostwriter messaging has specifically focused on Belarus' neighbors, Mandiant said, whereas Russia's anti-NATO information operations have been broader.

For example, Ghostwriter has practically ignored Estonia, which doesn't border Belarus.