Ghostwriter uses region restricted PDF files to deliver Cobalt Strike payloads exclusively to Ukrainian government targets, evading global security researchers.