Ghostwriter (UAC-0057 / UNC1151) Deploys Novel OYSTERBLUES Implant Against Ukrainian Government via Prometheus Learning Platform Lures — Active Since Spring 2026

CERT-UA disclosed this week that the Belarus-aligned APT Ghostwriter (UAC-0057 / UNC1151) has been running a sustained phishing campaign since spring 2026 against Ukrainian government entities, using lures impersonating the Prometheus online learning platform — a tool Ukrainian government employees routinely use — sent via previously compromised email accounts. The multi-stage kill chain delivers OYSTERFRESH (a JavaScript dropper displaying decoy documents), which stealthily encodes and writes OYSTERBLUES to the Windows Registry; OYSTERBLUES is then decoded by OYSTERSHUCK and beacons host profiling data (computer name, user, OS version, running processes) back to C2 infrastructure hidden behind Cloudflare using .icu TLD domains. Defenders should restrict wscript.exe execution for standard user accounts as an immediate mitigating control; the use of geofencing and trusted-platform social engineering signals deliberate operational refinement by this group.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.