Sugargh0st Rat

SugarGh0st RAT is a relatively new variant of the Gh0st RAT malware, first identified by researchers at Cisco Talos in November 2023. This Remote Access Trojan (RAT) has been used to carry out cyberespionage and surveillance campaigns against various targets, including government officials in Uzbekistan and South Korea. It shares code similarities with other malicious software like TunnelSpecter and SugarGh0st RAT, indicating possible connections between these threats. The RAT is often delivered via a self-extracting RAR file, which increases the likelihood of infection by eliminating the need for extra software. The SugarGh0st RAT has targeted a wide range of organizations, from U.S. telecommunications companies to international media organizations and South Asian government agencies. In most cases, the hackers have exploited publicly available email addresses to deliver the malware. Once inside the system, it can deploy a decoy document, a dynamic link library (DLL) loader, encrypted malware, and a malicious Visual Basic (VB) script for establishing persistence. The emergence of SugarGh0st RAT underscores the ongoing threat posed by cyberespionage activities. Notably, an unidentified group began using a modified version of this RAT to spy on targets in South Korea and the Ministry of Foreign Affairs in Uzbekistan. As such, organizations are advised to stay vigilant and implement robust cybersecurity measures to protect against these evolving threats.