How Ghostwriter uses leaked emails and Telegram to target Polish-Belarusian relations
01
02
03
04
05
June 2021
the same-pattern attack is broadly used by the whole Belarusian propaganda machine
September 2020
UNC1151 compromises Michał Dworczyk's private email and steals the documents
30 April 2021
the fake news is spread in Belarusian infosphere by the hack-and-leak (Russian-speaking) Telegram channel
February 2021
Belarusian propagandist reveals one of the documents on his blog
29 April 2021
the same document is used in the disinformation campaign and is published on hijacked accounts of PiS activist and the Head of Public Radio
NEXT
Successful phishing of Michał Dworczyk's private email
01
02
03
04
05
01
02
03
04
05
28 September 2020
Hackers compromise Michal Dworczyk's private email account with a successful phishing attempt. They get access to his email content - including the email from Belarussian oppositionists sent to Mr. Kotowicz (Dworczyk's associate), and later forwarded to Dworczyk. The document is a draft that will be misleadingly interpreted as an official proposal of the Polish government. The phishing itself is traced back to UNC1151, a cyberespionage group engaged in the Ghostwriter operation.
PREVIOUS
NEXT
Email leaks to Belarusian government media
01
02
03
04
05
6 February 2021
E-mail is first published by Yuri Terekh, a blogger and columnist for the Belarusian governmental newspaper SB.by on his personal Telegram channel. He misleadingly suggests that the author of the document is the director of Governmental Information Centre, Tomasz Matynia and the leak is a result of a drunken mishap by Kotowicz. The Telegram post is forwarded by channels of Slivy.news, anonymous blogger related to SB.by, and by the АТН, television news agency of Belteleradio (Belarusian state broadcaster).
PREVIOUS
NEXT
Ghostwriter operation makes use of the document
01
02
03
04
05
FAKE
29 April 2021
FAKE
Actors behind the Ghostwriter operation make use of the leaked document as source material in a disinformation attack.The hijacked Facebook account of an activist's from the ruling party and non-public Twitter profile of the Head of Polish state radio broadcaster, publish the document with fabricated comments.Both accounts were compromised in the phishing attacks (as was Dworczyk's email).
PREVIOUS
NEXT
Hack-and-leak Telegram spreads the fake news to Belarus
01
02
03
04
05
30 April 2021
Unbeknownst to the Polish audience, the screenshots from hacked accounts are used in the hack-and-leak Telegram channel dedicated to Russian-speaking audiences. The screens are used to authenticate the false narratives: - that the document is an official project by the Polish government - that financial support to Belarusian opposition is subject to harsh criticism even from members of the ruling party (the local PiS's activist is misleadingly described as an MP).
PREVIOUS
NEXT
The same-patern attack is spread all over Belarusian media
01
02
03
04
05
17 June 2021
The nearly identical disinformation attack takes place in June when the leak is already widely disputed in Poland. This time, the source material is a document with a grant proposal coming from the email of the president of the Solidarity International Foundation, which supports projects in the Eastern Partnership countries. The false narrative created by comments from hijacked social media accounts around the leak suggests that the criticism of Poland's support for the Belarusian opposition is cross-party and causes tensions both in Poland and Lithuania. This time, the fake news based on completely fabricated quotes is published on another Russian-speaking Telegram channel and forwarded by all the main state news outlets in Belarus.
PREVIOUS
NEXT
01
02
03
04
05
Reporters Foundation
VSQUARE - Ghostwriter on Telegram
Fundacja Reporterów
Created on August 9, 2021
Start designing with a free template
Discover more than 1500 professional designs like these:
Explore all templates
Transcript
How Ghostwriter uses leaked emails and Telegram to target Polish-Belarusian relations
01
02
03
04
05
June 2021
the same-pattern attack is broadly used by the whole Belarusian propaganda machine
September 2020
UNC1151 compromises Michał Dworczyk's private email and steals the documents
30 April 2021
the fake news is spread in Belarusian infosphere by the hack-and-leak (Russian-speaking) Telegram channel
February 2021
Belarusian propagandist reveals one of the documents on his blog
29 April 2021
the same document is used in the disinformation campaign and is published on hijacked accounts of PiS activist and the Head of Public Radio
NEXT
Successful phishing of Michał Dworczyk's private email
01
02
03
04
05
01
02
03
04
05
28 September 2020
Hackers compromise Michal Dworczyk's private email account with a successful phishing attempt. They get access to his email content - including the email from Belarussian oppositionists sent to Mr. Kotowicz (Dworczyk's associate), and later forwarded to Dworczyk. The document is a draft that will be misleadingly interpreted as an official proposal of the Polish government. The phishing itself is traced back to UNC1151, a cyberespionage group engaged in the Ghostwriter operation.
PREVIOUS
NEXT
Email leaks to Belarusian government media
01
02
03
04
05
6 February 2021
E-mail is first published by Yuri Terekh, a blogger and columnist for the Belarusian governmental newspaper SB.by on his personal Telegram channel. He misleadingly suggests that the author of the document is the director of Governmental Information Centre, Tomasz Matynia and the leak is a result of a drunken mishap by Kotowicz. The Telegram post is forwarded by channels of Slivy.news, anonymous blogger related to SB.by, and by the АТН, television news agency of Belteleradio (Belarusian state broadcaster).
PREVIOUS
NEXT
Ghostwriter operation makes use of the document
01
02
03
04
05
FAKE
29 April 2021
FAKE
Actors behind the Ghostwriter operation make use of the leaked document as source material in a disinformation attack.The hijacked Facebook account of an activist's from the ruling party and non-public Twitter profile of the Head of Polish state radio broadcaster, publish the document with fabricated comments.Both accounts were compromised in the phishing attacks (as was Dworczyk's email).
PREVIOUS
NEXT
Hack-and-leak Telegram spreads the fake news to Belarus
01
02
03
04
05
30 April 2021
Unbeknownst to the Polish audience, the screenshots from hacked accounts are used in the hack-and-leak Telegram channel dedicated to Russian-speaking audiences. The screens are used to authenticate the false narratives: - that the document is an official project by the Polish government - that financial support to Belarusian opposition is subject to harsh criticism even from members of the ruling party (the local PiS's activist is misleadingly described as an MP).
PREVIOUS
NEXT
The same-patern attack is spread all over Belarusian media
01
02
03
04
05
17 June 2021
The nearly identical disinformation attack takes place in June when the leak is already widely disputed in Poland. This time, the source material is a document with a grant proposal coming from the email of the president of the Solidarity International Foundation, which supports projects in the Eastern Partnership countries. The false narrative created by comments from hijacked social media accounts around the leak suggests that the criticism of Poland's support for the Belarusian opposition is cross-party and causes tensions both in Poland and Lithuania. This time, the fake news based on completely fabricated quotes is published on another Russian-speaking Telegram channel and forwarded by all the main state news outlets in Belarus.
PREVIOUS
NEXT
01
02
03
04
05
Reporters Foundation