Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
MalwareUsed by 6 actors

Ghost RAT

Gh0st RAT is a remote access Trojan/backdoor dating to at least 2008 and described in the provided content as originally developed by the Chinese threat actor C. Rufus Security Team. It is historically associated with the GhostNet campaign targeting Dalai Lama Tibetan exile centers, and multiple references in the content link its use or source-code lineage to China-nexus intrusion activity.

In the supplied reporting, Huntress assessed x.exe as a variant of Gh0st RAT used in an intrusion chain that began with compromise of an exposed, unauthenticated phpMyAdmin instance. The attackers abused MariaDB general query logging for log poisoning to write a PHP web shell, operated it with AntSword, deployed the legitimate Nezha monitoring agent as a staging and control mechanism, used PowerShell to add a Microsoft Defender exclusion for C:\WINDOWS, and then dropped and executed the Gh0st RAT variant from C:\Windows\Cursors. Huntress reported the malware installed persistence via a service named SQLlite, dropped SQLlite.exe into C:\Windows\system32, and determined SQLlite.exe was a renamed rundll32.exe used to load 32138546.dll. The sample created a mutex named gd.bj2[.]xyz:53762:SQLlite and communicated with gd.bj2[.]xyz, which resolved to 45.207.220[.]12. Huntress also reported the variant used a domain generation algorithm for C2, a multi-stage loader, dynamic API resolution, and command blocks consistent with China-nexus APT activity.

The campaign in which this Gh0st RAT variant was deployed reportedly affected more than 100 systems, with many victims in Taiwan, Japan, South Korea, and Hong Kong; additional victims appeared in other countries as well. The content states Ghost RAT and AntSword have both been used previously in activity publicly attributed to Chinese APT groups, and Huntress noted protocol similarities between the observed variant and malware reported by Zscaler in June 2025 linked to a China-nexus APT targeting Tibetan communities. Separately, Palo Alto Networks Unit 42 reported that the Phantom Taurus actor deployed backdoors likely borrowing source code from Ghost RAT.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Phantom Taurus

“...deploying backdoors that very likely borrowed source code from Ghost RAT, a Trojan developed by Chinese threat actor C. Rufus Security Team. Ghost RAT appears to date to 2008...”

via bank info securitybankinfosecurity.com
C. Rufus Security Team

“...deploying backdoors that very likely borrowed source code from Ghost RAT, a Trojan developed by Chinese threat actor C. Rufus Security Team. Ghost RAT appears to date to 2008...”

via bank info securitybankinfosecurity.com
china_nexus_apt

Huntress said Nezha was used in tandem with other families of malware and web shell management tools, such as Ghost RAT and AntSword. One of the first clues leading them to attribute the incident to Chinese actors was that, upon accessing the administrative interface of the compromised system, the hacker set the language to simplified Chinese. Minton added that even though Huntress stopped short of formally attributing the campaign to a specific Chinese threat actor, the use of Ghost RAT and AntSword was a clue because they both have been used before in activity publicly attributed to Chinese APT groups.

via the record mediatherecord.media
China-affiliated hackers

"...drop and run a Ghost RAT variant from 'C:\Windows\Cursors'. The RAT executable also installed a persistence mechanism and used a domain generation algorithm (DGA) for command & control (C2)."

via cso onlinecsoonline.com
YouSnake

"SilverFox activity: Antiy says the SilverFox (YouSnake) group infected over 17,000 users with the Ghost RAT..."

via risky biz rssnews.risky.biz
SilverFox

"SilverFox activity: Antiy says the SilverFox (YouSnake) group infected over 17,000 users with the Ghost RAT..."

via risky biz rssnews.risky.biz
MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1566PhishingEvidence1

This report focuses on the URLs embedded in emails that bypassed email security controls like secure email gateways (SEGs) to deliver malware.

T1566.002Spearphishing LinkEvidence1

Infection URLs are embedded in emails and represent the first action that a victim must take to become infected.

Execution

1 technique
T1059.001PowerShellEvidence1

After installing the Nezha agent, it was used to run an interactive PowerShell so that Windows Defender exclusions could be created before deploying and running another executable called x.exe.

Persistence

1 technique
T1543.003Windows ServiceEvidence1

Everything in the red boxes show the creation of a persistence mechanism using a service named “SQLlite,” with a similarly misspelled binary placed in the System32 directory.

Privilege Escalation

1 technique
T1543.003Windows ServiceEvidence1

Everything in the red boxes show the creation of a persistence mechanism using a service named “SQLlite,” with a similarly misspelled binary placed in the System32 directory.

Stealth

3 techniques
T1027.007Dynamic API ResolutionEvidence1

All WinApi functions are resolved dynamically using GetProcAddress and are stored into a large function table which is trivially reassembled.

T1036MasqueradingEvidence1

SQLlite.exe is actually a renamed rundll32.exe executable dropped by the malware used to load a MainThread exported function of 32138546.dll.

T1480.002Mutual ExclusionEvidence1

Upon execution, x.exe creates a mutex named gd.bj2[.]xyz:53762:SQLlite, which corresponds to the domain, port, and service name used by the malware.

Command and Control

2 techniques
T1071.001Web ProtocolsEvidence1

Each of these POST requests represents the attacker’s C2 server sending instructions to the compromised web server via the deployed web shell.

T1105Ingress Tool TransferEvidence1

The threat actor proceeded to download a secondary payload, an executable named live.exe, and an accompanying config.yml from a website built on Cloudflare pages: rism.pages[.]dev.

Other

1 technique
T1562.001Disable or Modify ToolsEvidence1

powershell.exe executed Add-MpPreference -ExclusionPath 'C:\WINDOWS' to disable Windows Defender scanning the Windows folder.

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app9 months ago
hash.sha256●●●●●●●●●●●●View more in app9 months ago
hash.sha256●●●●●●●●●●●●View more in app9 months ago
hash.sha256●●●●●●●●●●●●View more in app9 months ago
ip.v4●●●●●●●●●●●●View more in app9 months ago
ip.v4●●●●●●●●●●●●View more in app9 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution6

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.