meta_pixel
Tapesearch Logo
Log in
CyberWire Daily

Excel-lerating cyberattacks. [Research Saturday]

CyberWire Daily

N2K Networks, Inc.

Tech News, News, Daily News, Technology

4.61K Ratings

🗓️ 27 December 2025

⏱️ 23 minutes

🧾️ Download transcript

Summary

While our team is out on winter break, please enjoy this episode of Research Saturday. This week, we are joined by ⁠Tom Hegel⁠, Principal Threat Researcher from ⁠SentinelLabs⁠ research team, to discuss their work on "Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition." The latest Ghostwriter campaign, linked to Belarusian government espionage, is actively targeting Ukrainian military and government entities as well as Belarusian opposition activists using weaponized Excel documents. SentinelLabs identified new malware variants and tactics, including obfuscated VBA macros that deploy malware via DLL files, with payload delivery seemingly controlled based on a target’s location and system profile. The campaign, which began preparation in mid-2024 and became active by late 2024, appears to be an evolution of previous Ghostwriter operations, combining disinformation with cyberattacks to further political and military objectives. The research can be found here: ⁠Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition Learn more about your ad choices. Visit megaphone.fm/adchoices

Transcript

Click on a timestamp to play from that location

0:00.0

You're listening to the Cyberwire Network, powered by N2K.

0:10.1

As we take a short break for the holidays, we want to thank you for being part of our community

0:14.4

and for tuning in throughout the year. Today we're bringing you a special encore episode.

0:20.1

One will hope you enjoy revisiting or hearing for the first time.

0:24.1

However you're spending the season, we wish you happy holidays, a safe and restful break,

0:29.0

and as always, and attackers know it.

0:45.5

Threat Locker solves that by enforcing default deny at the point of execution.

0:50.3

With Threat Locker Allow listing, you stop unknown executables cold.

0:55.0

With ring fencing, you control how trusted applications behave.

0:58.0

And with Threat Locker, DAC, defense against configurations,

1:02.0

you get real assurance that your environment is free of misconfigurations,

1:06.0

and clear visibility into whether you meet compliance standards.

1:10.0

Threat Locker is the simplest way to enforce zero-trust principles without the operational pain.

1:15.6

It's powerful protection that gives CISO's real visibility, real control, and real peace of mind.

1:21.6

Threat Locker make zero-trust attainable, even for small security teams.

1:26.6

See why thousands of organizations choose Threat Locker to minimize alert fatigue,

1:31.6

stop ransomware at the source, and regain control over their environments.

1:36.3

Schedule your demo at Threatlocker.com slash N2K today. Hello, everyone and welcome to the CyberWires Research Saturday.

1:58.0

I'm Dave Bittner, and this is our weekly conversation with researchers and analysts

2:02.6

tracking down the threats and vulnerabilities, solving some of the hard problems and protecting

2:07.6

ourselves in our rapidly evolving cyberspace. Thanks for joining us.

2:16.6

Ghost Raider is an actor that we've been pretty closely tracking for some time.

...

Transcript will be available on the free plan in 6 days. Upgrade to see the full transcript now.

Disclaimer: The podcast and artwork embedded on this page are from N2K Networks, Inc., and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of N2K Networks, Inc. and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.

Copyright © Tapesearch 2026.