Taking a closer look at UNC1151. [Research Saturday]

Published: Oct. 9, 2021, 7 a.m.

b'Matt Stafford, Senior Threat Intelligence Researcher, from Prevailion joins Dave to talk about their work on "Diving Deep into UNC1151\\u2019s Infrastructure: Ghostwriter and beyond." Prevailion\\u2019s Adversarial Counterintelligence Team (PACT) used advanced infrastructure hunting techniques and Prevailion\\u2019s visibility into threat actor infrastructure creation to uncover previously unknown domains associated with UNC1151 and the \\u201cGhostwriter\\u201d influence campaign.\\xa0UNC1151 is likely a state-backed threat actor waging an ongoing and far-reaching influence campaign that has targeted numerous countries across Europe.\\xa0Their operations typically display messaging in general alignment with the security interests of the Russian Federation; their hallmarks include anti-NATO messaging, intimate knowledge of regional culture and politics, and strategic influence operations (such as hack-and-leak operations used in conjunction with fabricated messaging and/or forged documents).\\xa0PACT assesses with varying degrees of confidence that there are 81 additional, unreported domains clustered with the activity that FireEye and ThreatConnect detailed in their respective reports. PACT also assesses with High Confidence that UNC1151 has targeted additional European entities outside of the Baltics, Poland, Ukraine and Germany, for which no previous public reporting exists.\\nThe research can be found here:\\nDiving Deep into UNC1151\\u2019s Infrastructure: Ghostwriter and beyond'