Malware
Gh0st RAT
- First Reported
- Jun 21, 2024
- Latest Reported
- Sep 3, 2026
Reported Context (2)
- AsyncRAT combined high sample volume with high C2 configuration diversity, while Cobalt Strike and Gh0st RAT generated large submission volumes but reused comparatively small sets of C2 configurations. Recorded Future Reports 215 Actively Exploited CVEs and Expanding Supply-Chain Threats in H1 2026
- operators are likely Chinese-speaking based on their language preferences, the usage of the variants of Gh0st RAT — a popular malware among various Chinese-speaking actors — and the specific targets, which includes the SneakyChef Uses SFX RARs to Deliver SugarGh0st RAT in Government-Targeting Campaign
CVE (5)
Malware (52)
People (2)
Threat Actors (15)
MITRE ATT&CK (16)
Vendors (28)
Products (68)
Tools (14)
Industries (12)
Countries (16)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.