Gh0st

Gh0st is a form of malware, or malicious software, that has been used in a variety of cyber attacks to exploit and damage computer systems. Notably, it was used in Operation Diplomatic Specter, where the Gh0st RAT (Remote Access Trojan) sample and Specter malware family were deployed. The malware contains a modified Gh0st backdoor as a payload, allowing unauthorized access to the infected system. Variants of Gh0st RAT, including Win32/Farfli.BUR and Win32/Farfli.CUO, were found in the second Windows cluster during the operation. These variants, identified by their unique hashes, differed from the standard Gh0st RAT in several ways, including the absence of the "Gh0st" header, which was randomized based on a seed value received from GetTickCount. The Gh0st RAT malware also shares code similarities with other malware strains, such as TunnelSpecter and SugarGh0st RAT. The latter emerged in November 2023 and was observed by Talos researchers targeting governments in Asia. While no clear similarity was found between TunnelSpecter and Gh0st RAT, a shared similarity was identified with another backdoor discovered during the attacks, SweetSpecter. This malware utilizes Gh0st RAT's known TCP communication scheme, sending a zlib compressed TCP packet to the command and control server. Operation Diplomatic Specter highlighted the use of customized Gh0st RAT samples in its attacks. One such example was a large file named Tpwinprn.dll, which was the first Gh0st RAT binary encountered during the attacks. Interestingly, this string was also observed in the Gh0st RAT variant used in an earlier campaign, Operation Iron Tiger, back in 2015. This demonstrates the enduring nature of the Gh0st RAT malware, which continues to be a significant threat due to its adaptability and the ability of its operators to customize it for specific attacks.