{
  "family": "gh0st",
  "sample_count": 4,
  "category": "rat",
  "description": "Gh0st RAT is a long-standing, modular Remote Access Trojan (RAT) that has been active since at least 2008. Because its source code is publicly available, numerous threat actors have modified and deployed it, making it a persistent and frequently encountered threat. Gh0st RAT provides attackers with full, interactive control over an infected system, including remote desktop access, keystroke logging, webcam/microphone hijacking, and file management. Modern campaigns often deliver Gh0st RAT through sophisticated methods like fake installers, spam emails, and malicious loaders, using techniques like DLL sideloading to bypass security controls.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Gh0st RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Gh0st RAT is a widely distributed Remote Access Trojan that allows attackers to take full control over a victim's computer, including screen sharing, keylogging, and file manipulation."
      }
    },
    {
      "@type": "Question",
      "name": "How is Gh0st RAT typically deployed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is commonly spread via spam and phishing emails, fake software installers, and malicious loaders that may bundle the RAT with other threats like adware."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Gh0st RAT so common?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The original source code for Gh0st RAT was released publicly many years ago, allowing a wide variety of threat actors to easily modify, customize, and deploy their own versions of the malware."
      }
    }
  ],
  "faq_count": 3,
  "mitre_attack": [],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}