.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
Summary
CTU researchers assess with high confidence that MOONSCAPE obtained unauthorized access to account credentials to support espionage and intelligence operations.
Operating since at least 2020, the group conducted persistent spearphishing campaigns against Ukrainian, Latvian, German, Polish and Lithuanian speaking targets. These campaigns exploited email validation or verification themes, and had been observed spoofing popular webmail providers, national information services, social media platforms and military entities.
MOONSCAPE had been publicly linked to the Ghostwriter influence campaign. Ghostwriter involved propagating narratives, critical of NATO presence in Eastern Europe, designed to influence public opinion in Lithuania, Latvia and Poland. CTU researchers assess with moderate confidence that MOONSCAPE was Belarusian or Russian in origin.
Operating since at least 2020, the group conducted persistent spearphishing campaigns against Ukrainian, Latvian, German, Polish and Lithuanian speaking targets. These campaigns exploited email validation or verification themes, and had been observed spoofing popular webmail providers, national information services, social media platforms and military entities.
MOONSCAPE had been publicly linked to the Ghostwriter influence campaign. Ghostwriter involved propagating narratives, critical of NATO presence in Eastern Europe, designed to influence public opinion in Lithuania, Latvia and Poland. CTU researchers assess with moderate confidence that MOONSCAPE was Belarusian or Russian in origin.
Contact us
Contact us directly whether your organization needs immediate assistance or
you want to discuss your incident readiness, response, and testing needs.