Threat intelligence / Campaign

Operation Ghost

[Operation Ghost](https://attack.mitre.org/campaigns/C0023) was an [APT29](https://attack.mitre.org/groups/G0016) campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. embassy of a European Union country. During [Operation Ghost](https://attack.mitre.org/campaigns/C0023), [APT29](https://attack.mitre.org/groups/G0016) used new families of malware and leveraged web services, steganography, and unique C2 infrastructure for each victim.(Citation: ESET Dukes October 2019)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Operation Ghost](https://attack.mitre.org/campaigns/C0023) was an [APT29](https://attack.mitre.org/groups/G0016) campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. embassy of a European Union country. During [Operation Ghost](https://attack.mitre.org/campaigns/C0023), [APT29](https://attack.mitre.org/groups/G0016) used new families of malware and leveraged web services, steganography, and unique C2 infrastructure for each victim.(Citation: ESET Dukes October 2019)

14 recorded

Relationships

attributed-to

Group

uses

to Bidirectional Communication

Technique

uses

to Domain Accounts

Technique

uses

Technique

uses

Malware

uses

Technique

uses

Malware

uses

to PolyglotDuke

Malware

uses

Tool

uses

Malware

uses

to Social Media Accounts

Technique

uses

to Steganography

Technique

uses

to Steganography

Technique

uses

to Windows Management Instrumentation Event Subscription

Technique

2 external

References

mitre-attack

C0023

ESET Dukes October 2019

https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf