{
  "Event": {
    "analysis": "1",
    "date": "2026-06-12",
    "extends_uuid": "",
    "info": "[Threat Intel] UNC1151/Ghostwriter phishing campaign targeting Gmail accounts",
    "protected": false,
    "publish_timestamp": "1782230726",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782230726",
    "uuid": "5c1e7285-f735-49d8-9fcf-ef31d47b10ae",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#809a25",
        "local": false,
        "name": "misp-galaxy:target-information=\"Poland\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Ghostwriter\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578838",
        "to_ids": false,
        "type": "link",
        "uuid": "e7465074-00eb-43d2-9971-8cca387ef356",
        "value": "https://cert.pl/en/posts/2026/06/UNC1151-gmail-campaign/",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578838",
        "to_ids": false,
        "type": "text",
        "uuid": "d5023937-becc-439c-9944-a336506d7b6b",
        "value": "The UNC1151/Ghostwriter group is conducting high-intensity phishing campaigns targeting Gmail accounts of Polish citizens since March 2026. The campaigns primarily target individuals in political and public life, prominent positions, researchers, journalists, public administration and law enforcement employees, and their associates. Attackers use fraudulent emails impersonating Gmail administrators, claiming suspicious activity or policy violations to pressure victims into verifying their accounts. The phishing infrastructure captures login credentials and two-factor authentication codes through fake login panels. The group utilizes dedicated domains, Netlify subdomains, and compromised websites to host phishing pages. Campaigns run primarily on weekdays with new domains appearing almost daily, demonstrating persistent operational tempo against Polish targets."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578838",
        "to_ids": false,
        "type": "text",
        "uuid": "b630b6c2-442d-4c27-b184-12c1e1be43e4",
        "value": "Name: UNC1151/Ghostwriter phishing campaign targeting Gmail accounts\nAuthor: AlienVault\nAdversary: Ghostwriter\nTags: [\"unc1151\", \"gmail\", \"phishing\", \"poland\", \"2fa bypass\", \"credential theft\", \"apt\", \"ghostwriter\"]\nTgtd countries: [\"Poland\"]\nMlwr families: []\nAttack_ids: []\nIndustries: [\"Government\", \"Media\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782096822",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "6cc213a3-5154-4ffd-ace8-61d7f3f0e8e6",
        "value": "Ghostwriter",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"Ghostwriter\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102479",
        "to_ids": true,
        "type": "domain",
        "uuid": "377ddda4-3239-47a4-8a9e-52ecaf63e6b2",
        "value": "mailverify.digital",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102500",
        "to_ids": true,
        "type": "domain",
        "uuid": "73f22e30-aeeb-49c4-b739-f4f3ee7c2113",
        "value": "check-mail-verify.biz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102521",
        "to_ids": true,
        "type": "domain",
        "uuid": "0d089c31-2216-47eb-8b89-57964f2158e0",
        "value": "verify-check.digital",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782096834",
        "to_ids": true,
        "type": "email-src",
        "uuid": "4a89d2b4-62e3-4309-892a-c28e07aed43d",
        "value": "mailnotify24@gmail.com"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782096834",
        "to_ids": true,
        "type": "email-src",
        "uuid": "f09eecf2-36dc-493b-a186-e5b450559757",
        "value": "mailersupport24@gmail.com"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782096834",
        "to_ids": true,
        "type": "email-src",
        "uuid": "64cef0e8-db0c-4f81-896f-73e86fb6feb7",
        "value": "support.security.inf@gmail.com"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782096834",
        "to_ids": true,
        "type": "email-src",
        "uuid": "c0ff5365-b9bf-4614-8cee-c94bef563196",
        "value": "monitoring.konta@gmail.com"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782096834",
        "to_ids": true,
        "type": "email-src",
        "uuid": "be0ba5a3-bb84-48ee-90b3-801349632d53",
        "value": "walidacjagrupapocztowa@gmail.com"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782096834",
        "to_ids": true,
        "type": "email-src",
        "uuid": "030facfc-e397-42ea-8e7a-7513115ee272",
        "value": "naruszen.detekcja@gmail.com"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782096834",
        "to_ids": true,
        "type": "email-src",
        "uuid": "3e4d199c-2f1b-4596-a500-3a60dc661c96",
        "value": "serwis.pomoc.techniczna@gmail.com"
      },
      {
        "category": "Network activity",
        "comment": "Netlify service abuse",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102542",
        "to_ids": true,
        "type": "hostname",
        "uuid": "b78e32a7-25fb-4140-b900-1ae3bbad8af4",
        "value": "monitoring-google-konta.netlify.app",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Netlify service abuse",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102563",
        "to_ids": true,
        "type": "hostname",
        "uuid": "38ed5e5b-4424-4719-93d6-af135c67f4cf",
        "value": "konta-24weryfikacja.netlify.app",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Netlify service abuse",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102585",
        "to_ids": true,
        "type": "hostname",
        "uuid": "930890b2-4453-4043-9b20-c0914311f35c",
        "value": "service-auth.netlify.app",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}