Ghostwriter Cyber-Attack Targets Ukrainian, Belarusian Opposition

SentinelLABS uncovered a Ghostwriter APT campaign delivering multi-stage malware via weaponized Excel spreadsheets with obfuscated VBA macros (writing a disguised DLL, executing it via regsvr32, and loading .NET assemblies) that targets Ukrainian government entities and Belarusian opposition figures; the group uses PicassoLoader, domain spoofing, PE header modification, and other obfuscation techniques, and organizations in the region are advised to disable macros, use email filtering and EDR, and monitor network activity.