Sugargh0st

SugarGh0st is a malicious software (malware) variant first identified by Cisco Talos in November of the previous year. The malware, believed to be connected to China, has been deployed in cyberespionage campaigns primarily targeting the Ministry of Foreign Affairs in Uzbekistan and users in South Korea. SugarGh0st, a fully functional backdoor capable of executing most remote control functionalities, shares code similarities with TunnelSpecter and is a Remote Access Trojan (RAT). Initial infections are suspected to trace back to phishing emails containing a malicious JavaScript serving as a SugarGh0st loader. The SugarGh0st RAT has been used by the China-linked SugarGh0st Team, alongside other espionage groups such as Cloud Atlas and Sticky Werewolf, who have targeted government agencies in Belarus. The malware communicates with an attacker-controlled Command and Control (C2) server to complete the infection chain. Notably, a self-extracting RAR file is often used in these attacks, which drops a decoy document, a dynamic link library (DLL) loader, encrypted malware (either SugarGh0st RAT or SneakyChef's newest tool, SpiceRAT), and a malicious Visual Basic (VB) script for establishing persistence. Researchers have noted Chinese language preferences present in the malware's code, suggesting its origin. The use of SugarGh0st RAT, particularly popular among Chinese threat actors, and the similar profile of its targets further corroborate this hypothesis. The malware variant has evolved since its inception, with an unidentified group using a modified version, nicknamed "SugarGh0st RAT," to spy on targets in South Korea and the Ministry of Foreign Affairs in Uzbekistan.