SecuriTricks - gh0st rat

RONINGLOADER: DragonBreath's New Path to PPL Abuse

Elastic Security Labs uncovered a campaign by DragonBreath APT using a multi-stage loader named RONINGLOADER to deploy an updated gh0st RAT variant. The malware employs various evasion techniques targeting Chinese EDR tools, including signed driver abuse, thread-pool injection, and PPL exploitation…

apt

gh0st rat

thread-pool injection

chinese edr evasion

roningloader

Published: November 19, 2025

Downloadable IOCs: 14

Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT

This report details two interconnected malware campaigns targeting Chinese-speaking users in 2025, using large-scale brand impersonation to deliver Gh0st RAT variants. The first campaign, active from February to March, mimicked three brands across over 2,000 domains. The second campaign, starting i…

gh0st rat

dll side-loading

brand impersonation

chinese-speaking targets

multi-stage infection

cloud infrastructure

2025-11-15

domain generation

Published: November 15, 2025

Downloadable IOCs: 0

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

Phantom Taurus, a newly identified Chinese state-sponsored threat actor, has been conducting espionage operations targeting government and telecommunications organizations across Africa, the Middle East, and Asia. The group's primary focus includes ministries of foreign affairs, embassies, and mili…

Published: September 30, 2025

Downloadable IOCs: 4

Pacific Rim timeline: Information for defenders from a braid of interlocking attack campaigns

Sophos unveils a five-year investigation tracking China-based threat actors targeting perimeter devices, particularly Sophos firewalls. The report details multiple attack campaigns, including Asnarök, Bookmark Buffer Overflow, and Covert Channels, which exploited zero-day vulnerabilities to gain ac…

sliver

gh0st rat

backdoors

critical infrastructure

china-based threat actors

CVE-2022-3236

asnarök

zero-day vulnerabilities

asia-pacific targets

CVE-2022-1292

Published: October 31, 2024

Downloadable IOCs: 0

Toneshell Backdoor Used to Target Attendees of the IISS Defence Summit

A cyber espionage campaign using the ToneShell backdoor, associated with Mustang Panda, has been detected targeting attendees of the 2024 IISS Defence Summit in Prague. The attack utilizes a malicious PIF file masquerading as summit documents, which drops SFFWallpaperCore.exe and libemb.dll. The ma…

Published: September 5, 2024

Downloadable IOCs: 4

Introducing Gh0stGambit: A Dropper for Deploying Gh0st RAT

This analysis examines a recent malware campaign involving a dropper dubbed Gh0stGambit, which is employed to retrieve and execute encrypted payloads, specifically a variant of the notorious Gh0st Remote Access Trojan (RAT). The report details the multi-stage infection process, including the use of…

Published: July 31, 2024

Linked vulnerabilities : CVE-2024-5806 (CVSS 7.4)

Downloadable IOCs: 6

CVE-2024-4577 Exploits in the Wild One Day After Disclosure

One of the most recent examples of this onslaught lies in a critical vulnerability discovered in PHP (versions 8.1.*, before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8). The vulnerability is caused by the way PHP and CGI handlers parse certain Unicode characters, which can enable an attack…

Published: July 11, 2024

Downloadable IOCs: 17

Operation Specter: An Active Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

An analysis reveals long-term espionage operations by a Chinese advanced persistent threat (APT) group against at least seven governmental entities across the Middle East, Africa and Asia since late 2022. The threat actor attempts to obtain sensitive and classified information about diplomatic and …

Published: May 23, 2024

Linked vulnerabilities : CVE-2021-34473, CVE-2021-26855

Downloadable IOCs: 28

Tag: gh0st rat

Attack reports

RONINGLOADER: DragonBreath's New Path to PPL Abuse

Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

Gh0st RAT-based GodRAT attacks financial organizations

Analysis of T-Rex CoinMiner Attacks Targeting Internet Cafés in Korea

Operation SalmonSlalom

Threat Bulletin: Weaponized Software Targets Chinese-Speaking Organizations

New Winos 4.0 Malware Infects Gamers Through Malicious Game Optimization Apps

Pacific Rim timeline: Information for defenders from a braid of interlocking attack campaigns

Toneshell Backdoor Used to Target Attendees of the IISS Defence Summit

Introducing Gh0stGambit: A Dropper for Deploying Gh0st RAT

CVE-2024-4577 Exploits in the Wild One Day After Disclosure

Operation Specter: An Active Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia