EU takes aim at Russia over ‘Ghostwriter’ hacking campaign against politicians, government officials

The European Union formally blamed Russia on Friday, just ahead of this weekend’s German elections, for a hacking campaign targeting EU government officials and politicians.

And the EU is threatening to take unspecified action. “The European Union will revert to this issue in upcoming meetings and consider taking further steps,” reads a statement from the high representative of the EU.

Known as Ghostwriter, the campaign drawing the EU’s ire has previously taken aim at NATO and launched disinformation efforts as well, according to researchers who have tied its goals to Russian interests but not attributed it to the government.

“The European Union and its Member States strongly denounce these malicious cyber activities, which all involved must put to an end immediately,” the EU statement reads. “We urge the Russian Federation to adhere to the norms of responsible state behaviour in cyberspace.”

The EU says that Ghostwriter targets in its member nations include civil society groups, government officials, parliaments, politicians and the press. The campaign has been “accessing computer systems and personal accounts and stealing data,” according to the statement.

The warning to Russia echoes Germany calling out the Kremlin over the Ghostwriter campaign earlier this month. Germany also had called attention to Ghostwriter targeting its parliament in March.

While the U.S. in the 2020 election might have avoided significant Russian election interference after the Kremlin’s hacking of Democratic emails and disinformation campaigns in 2016, by many accounts Russia has remained unrelenting in Europe. Russia routinely denies accusations of malfeasance in cyberspace.

In April, the cybersecurity firm FireEye linked Ghostwriter to 30 incidents in the last five years aimed at sowing political discord in places like Lithuania, Latvia and Poland to undermine NATO.

FireEye found ties between Ghostwriter and a cyber-espionage group that has been active since 2017. Prevailion also has scrutinized Ghostwriter activity.