Ghostemperor

GhostEmperor, also known as Salt Typhoon and FamousSparrow, is a threat actor that has been active since August 2019. The group is linked to China's Ministry of State Security and is recognized for its sophisticated cyber campaigns primarily targeting high-profile entities in Southeast Asia, including Malaysia, Thailand, Vietnam, and Indonesia. GhostEmperor was first identified in September 2021 by Kaspersky, which highlighted the group's use of multistage malware designed for stealth and persistence, leveraging rootkits and other advanced tools to maintain a foothold in compromised networks. The group has recently escalated its activities and breached U.S. broadband providers, including Verizon, AT&T, and Lumen Technologies. This breach potentially gave them access to systems for lawful wiretapping and other data. The compromised network was subsequently used as a launchpad to infiltrate another victim's systems, marking the first confirmed activity from GhostEmperor since 2021. However, there is currently no information available on how the attackers might have gained access to the lawful intercept infrastructure. In the most recent breach, GhostEmperor employed the WMIExec tool from the Impacket Toolkit to execute commands remotely via Windows Management Instrumentation (WMI), initiating the infection chain on the compromised machine. Ram Elboim, CEO of Sygnia, noted that Salt Typhoon performed extensive reconnaissance, indicating a high level of preparation and sophistication in their attacks. As such, GhostEmperor continues to pose a significant cybersecurity threat globally.