Ghostwriter/UAC-0057 Resurfaces with OYSTERFRESH/OYSTERBLUES Malware Chain, Abusing Prometheus Learning Platform as Lure Against Ukrainian Government Targets

CERT-UA disclosed on May 22, 2026 that Belarus-aligned APT Ghostwriter (UAC-0057/UNC1151) has been running an active phishing campaign against Ukrainian government organizations since spring 2026, using lures themed around Prometheus — a legitimate Ukrainian e-learning platform actually used by government employees — to increase credibility. Phishing emails deliver PDF attachments linking to ZIP archives containing OYSTERFRESH, a JavaScript dropper that displays a decoy document while covertly writing the encrypted OYSTERBLUES backdoor to the Windows Registry and downloading the OYSTERSHUCK decoder; OYSTERBLUES collects system fingerprint data (hostname, user account, OS version, running processes) and beacons to C2 infrastructure hidden behind Cloudflare across .icu TLD domains. CERT-UA recommends restricting wscript.exe execution for standard user accounts as the most effective immediate mitigation against this JavaScript-based delivery chain.

CERT-UA recommends restricting wscript.exe execution for standard user accounts as the most effective immediate mitigation against this JavaScript-based delivery chain.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.