Gh0strat

Gh0stRAT is a malware, specifically a Remote Access Trojan (RAT), that was first observed in 2008. Over the years, its publicly available source code has been modified by various authors and threat actors, resulting in several variants such as Sainbox. For over a decade, Gh0stRAT and related variants have been consistently exploited in different cybercrime circles. Recently, Proofpoint researchers have noted a minor resurgence in the use of Sainbox and other Chinese-themed malware, which has sparked interest among analysts assessing the broader impact of older malware. In 2023, Proofpoint observed an increase in the use of Sainbox, a variant of Gh0stRAT. Additionally, a handful of Chinese language campaigns were seen delivering older Gh0stRAT variants. Nearly all these Sainbox campaigns used invoice-themed lures spoofing Chinese office and invoicing companies. This trend continued into 2024 with the May campaign, dubbed UNK_SweetSpecter, employing SugarGh0st RAT, a remote access trojan tailored from the Gh0stRAT. The combination of older malware like Sainbox and newly uncovered malware like ValleyRAT may challenge the dominance of the Russian-speaking cybercrime market on the threat landscape. The continued use and evolution of Gh0stRAT variants indicate a persistent threat to cybersecurity. It's crucial for organizations to stay vigilant against these threats, particularly as they evolve and adapt to new security measures.