{
  "family": "ghost",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nGhost RAT (Remote Access Trojan), originally released as the \"Gh0st RAT,\" is one of the most infamous, pervasive, and influential backdoors in the history of cyber espionage. Since its source code was publicly released in the late 2000s, it has been heavily modified and utilized by countless threat actors, ranging from script kiddies to sophisticated Chinese state-sponsored APT groups (like APT18 and APT27). It provides complete, administrative control over a compromised Windows system.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGhost RAT is primarily distributed via targeted spear-phishing campaigns (often utilizing malicious Excel or Word documents with exploit payloads) or dropped as a secondary payload by other malware.\n\nOnce executed, Ghost RAT exhibits powerful and stealthy capabilities:\n<ul>\n<li><strong>Complete System Control:</strong> It grants the remote attacker full administrative capabilities, including a live interactive command shell, a file manager (upload/download/execute), registry editing, and service management.</li>\n<li><strong>Advanced Surveillance:</strong> Ghost RAT is notorious for its comprehensive surveillance modules. It can capture live screenshots, record audio from the microphone, intercept webcam feeds, and log all keystrokes in real-time.</li>\n<li><strong>Network Proxying and Zombification:</strong> The RAT can be configured to act as a proxy, allowing the attacker to route traffic through the infected host. Furthermore, the malware acts as a botnet client, allowing attackers to coordinate massive DDoS attacks using the compromised infrastructure.</li>\n<li><strong>Evasion:</strong> The malware often uses process injection (hollowing out `svchost.exe`) to hide its execution and modifies the registry (via `Run` keys or creating malicious services) for persistence.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Ghost RAT infection is a critical security incident. Its presence signifies total compromise of the endpoint. The threat actor possesses the ability to exfiltrate any data on the machine, monitor all user activity, and use the machine as a beachhead to pivot laterally into the corporate network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to sever the connection to the C2 server by instantly isolating the infected endpoint from the LAN.</li>\n<li><strong>Memory Forensics:</strong> Because Ghost RAT frequently utilizes process injection, memory forensics (e.g., using Volatility) is often required to identify the injected processes and extract the specific C2 configuration and network indicators.</li>\n<li><strong>Total Re-imaging:</strong> Attempting to \"clean\" a Ghost RAT infection is highly dangerous due to its deep hooks and rootkit-like capabilities. The endpoint must undergo a complete bare-metal wipe and re-image, alongside a global reset of all associated user credentials.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.GhostRAT",
    "Backdoor.Gh0st",
    "Win32/Ghost",
    "Gh0st"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055.001",
    "T1071.001",
    "T1056.001",
    "T1125",
    "T1123"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:23:02Z",
  "type": "Remote Access Trojan (RAT)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}