UNC1151 Phishing Email Targeting Belarusian Politician Points to Multi-National Campaign

This Censys analysis details an active UNC1151 (Ghostwriter/FrostyNeighbor) credential-phishing campaign that targeted a Belarusian politician and Ukrainian users by hosting fake Google and local-portal login pages, using WebSocket backends to capture credentials and bypass MFA. The report documents infrastructure pivots via certificate data to reveal hosting IPs, lists multiple impersonation domains and certificate SHA256 values, and concludes the activity is a broad and ongoing phishing operation rather than an isolated incident.