iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
No: the claim that a Polish criminal ring was harvesting organs from Ukrainian refugees was fabricated, and investigators found no evidence that it happened. In a May 19, 2022 analysis, Mandiant said Ghostwriter used compromised online assets to publish the story in a way that could make it look like credible local reporting.
What did the hoax claim?
The fabricated story alleged that a Polish criminal enterprise was harvesting organs from Ukrainian refugees for illegal trafficking in the European Union. It also falsely claimed that Poland’s Internal Security Agency was investigating high-ranking officials. The story was designed to inflame tensions between Poland and Ukraine and undermine confidence in support for refugees and NATO.
Reporting on the claim found no evidence of organ harvesting. The allegation should be treated as a disinformation narrative, not as a report of an established crime.
How did Ghostwriter make the story appear credible?
Mandiant reported that Ghostwriter published the fabricated content using compromised legitimate assets. Using existing channels can make a false story appear to come from a familiar or trusted local source, rather than from an obviously fake account.
#1 Best Overall
The operation fit a broader pattern of cyber-enabled influence activity around Russia’s full-scale invasion of Ukraine. Mandiant described tactics including fabricated articles, coordinated inauthentic accounts, compromised websites, and hack-and-leak activity. It said the strategic aims of Russian- and Belarusian-aligned operations included demoralizing Ukrainians, dividing Ukraine from its allies, and bolstering perceptions of Russia.
Who was behind the operation?
Mandiant’s attribution distinguishes between the technical actor UNC1151, Ghostwriter’s information operations, and possible Russian involvement. Its November 16, 2021 assessment linked UNC1151 to the Belarusian government with high confidence. Mandiant assessed Ghostwriter operations as supporting Belarusian government interests with high confidence, but assessed Belarusian sponsorship with moderate confidence.
Rank #2
Mandiant said it could not rule out Russian contributions to UNC1151 or Ghostwriter, but had not uncovered direct evidence of them. That leaves Russian involvement unconfirmed; it does not establish that Russia directed this particular hoax.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How did the false claim spread?
After the story was seeded through compromised assets, it was amplified by Russian-state media and circulated on Telegram, Twitter, English-language websites, and other platforms, according to reporting summarized by Mandiant. That distinction matters: initial publication through compromised channels and later amplification are separate parts of the spread.
Rank #3
Mandiant senior analyst Alden Wahlstrom said Ghostwriter operations often piggyback on current events. He described recurring motives as “Undercutting trust in NATO” and “Creating tensions.” A refugee-focused allegation during a major displacement crisis could serve both aims by fostering suspicion between neighboring countries and weakening support for people fleeing the war.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should readers take away?
- The organ-harvesting allegation was fabricated; no evidence of the alleged crime surfaced.
- Ghostwriter used compromised assets to make the story look like it came from legitimate local channels.
- Mandiant linked UNC1151 to Belarus with high confidence, while its assessment of Ghostwriter’s Belarusian sponsorship was moderate-confidence.
- Mandiant had not found direct evidence of Russian-government involvement, although it did not rule out Russian contributions.
- The claim was subsequently amplified through state-media and online channels, extending its reach beyond the initial publication.
Mandiant warned that these operations threatened Ukraine as well as the United States and other Western countries, and anticipated that such activity would continue as the conflict progressed.
Quick Recap
Sources
- Mandiant, May 19, 2022 analysis
- Mandiant, November 16, 2021 attribution assessment
- Mandiant analysis of information operations around the war
- Reporting on the hoax’s amplification and Mandiant analyst Alden Wahlstrom
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
