{
  "family": "ghost",
  "sample_count": 1,
  "category": "rat",
  "description": "Gh0st RAT (also tracked in security taxonomies as GhostRAT or Backdoor.Gh0st) is a seminal open-source Remote Access Trojan originally authored in 2008 by the Chinese Red Hacker Alliance (Honker Union of China). Developed in C++ with Microsoft Foundation Classes (MFC), Gh0st RAT was engineered to provide real-time remote surveillance over high-latency networks, featuring real-time screen transmission, audio eavesdropping, remote shell execution, webcam capture, and full file system management.\n\nGh0st RAT entered the global spotlight in March 2009 during the landmark 'GhostNet' investigation conducted by the Munk School of Global Affairs at Citizen Lab. The research uncovered an expansive cyber espionage apparatus that systematically infected at least 1,295 computers across 103 countries—infiltrating the private offices of the Dalai Lama, the Tibetan government-in-exile, foreign ministries, and international embassies. Because its source code was publicly released, countless state-sponsored APT groups (including APT27, APT30, and TA428) customized its network header (substituting the default 'Gh0st' 5-byte magic header with 'KrisR', 'Oxeed', 'HTTPS', or 'B0SS') and deployed it across hundreds of espionage campaigns for over a decade.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Gh0st RAT",
    "Gh0st",
    "GhostRAT",
    "Backdoor.Gh0st",
    "Win32/Ghost",
    "Trojan.GhostRAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Gh0st RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Gh0st RAT is an open-source C++ Remote Access Trojan released in 2008 that provides full remote desktop management, keystroke logging, and audio surveillance."
      }
    },
    {
      "@type": "Question",
      "name": "What was the GhostNet espionage network?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "GhostNet was a massive cyber espionage operation uncovered in 2009 by Citizen Lab that used Gh0st RAT to infiltrate over 1,200 computers in 103 countries, including embassies and the office of the Dalai Lama."
      }
    },
    {
      "@type": "Question",
      "name": "How does Gh0st RAT frame its network traffic?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Gh0st RAT frames network packets with a 5-byte magic header (such as 'Gh0st', 'KrisR', or 'HTTPS') followed by packet size indicators and zlib-compressed command payloads."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Gh0st RAT still encountered today?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because its complete source code was publicly released in 2008, diverse cyber espionage and criminal groups continually recompile and customize it with new headers, packers, and transport encryptions."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect Gh0st RAT traffic?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders use IDS/IPS signatures targeting common 5-byte magic headers and zlib stream headers, alongside endpoint behavioral rules flagging unauthorized service creations."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1056.001",
    "T1113",
    "T1125",
    "T1071.001",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:23:02Z",
  "type": "Remote Access Trojan (RAT)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2008,
  "lineage": {
    "derived_from": [],
    "variants": [
      "gh0st rat v3.6 (open source)",
      "gh0st rat beta 3.7",
      "custom magic-header variants (krisr, oxeed, https, b0ss)"
    ]
  },
  "attribution": [
    {
      "actor": "Red Hacker Alliance (Honker Union) / Chinese APT Groups (GhostNet Investigation)",
      "confidence": "high",
      "basis": "Authored by Red Hacker Alliance in 2008. Groundbreaking Citizen Lab GhostNet investigation in 2009 documented widespread state-sponsored surveillance across diplomatic and government targets in 103 countries.",
      "source": "https://attack.mitre.org/software/S0032/"
    }
  ],
  "exploited_cves": [
    "CVE-2006-0003",
    "CVE-2008-2244",
    "CVE-2012-0158"
  ],
  "c2_profile": {
    "protocols": [
      "TCP",
      "Custom Binary Protocol",
      "Zlib Compression",
      "5-Byte Magic Header"
    ],
    "ports": [
      80,
      443,
      8080,
      1982
    ],
    "infrastructure": "Dynamic DNS and dedicated C2 servers communicating over raw TCP sockets using a 5-byte magic header (default 'Gh0st') followed by a 4-byte payload size and zlib-compressed command structures."
  },
  "iocs": {
    "file_hashes": [
      "2efb6d17b5e4c6981cfda552553ca4be969796ff07a835a96aef71a2ec703ce5",
      "b1b4c330f89fa6d165f973e20e8b22a08846c4f09a5b3a8634860b0ec89c565d"
    ],
    "delivery": [
      "Targeted spear-phishing with malicious attachments exploiting Microsoft Word and Office vulnerabilities (CVE-2012-0158)",
      "Self-extracting archives (SFX) disguised as news releases, embassy reports, or human rights manifestos"
    ],
    "persistence": [
      "Service registration disguised as legitimate Windows services (e.g., 'RapiClient' or 'WinHost')",
      "Run registry key creation under HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    ]
  },
  "sources": [
    {
      "name": "Citizen Lab - Tracking GhostNet: Investigating a Cyber Espionage Network",
      "url": "https://citizenlab.ca/2009/03/tracking-ghostnet-investigating-a-cyber-espionage-network/"
    },
    {
      "name": "MITRE ATT&CK - Gh0st RAT (S0032)",
      "url": "https://attack.mitre.org/software/S0032/"
    },
    {
      "name": "CISA Advisory - Remnant Threats of Legacy Open-Source Backdoors",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1125",
      "name": "Video/Audio Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (C2 Communication)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised host from internal LAN and WAN environments to cut off interactive remote shell sessions established by Ghost.",
    "Inspect active socket listeners and outbound established network connections ('netstat -ano') to identify and sever covert TCP/UDP channels used by Ghost.",
    "Scan Windows Services, Scheduled Tasks, and Startup folders to locate and eliminate persistent backdoor listeners configured by Ghost.",
    "Invalidate all active VPN profiles, local administrator credentials, and session tokens that may have been harvested by the Ghost operator.",
    "Re-image the affected host using a validated golden image prior to reconnecting it to enterprise network segments."
  ],
  "what_to_avoid": [
    "Do not attempt to interact with or send messages through the Ghost remote terminal, as this alerts the attacker and may cause them to execute destructive anti-forensic commands.",
    "Avoid relying solely on static file signatures, as Ghost payloads frequently execute reflectively in memory without writing binaries to disk."
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}