Malware
Ghost RAT
Also known as: Farfli · Gh0st RAT · PCRat
According to Security Ninja, Gh0st RAT (Remote Access Terminal) is a trojan “Remote Access Tool” used on Windows platforms, and has been used to hack into some of the most sensitive computer networks on Earth. Below is a list of Gh0st RAT capabilities. Take full control of the remote screen on the infected bot. Provide real time as well as offline keystroke logging. Provide live feed of webcam, microphone of infected host. Download remote binaries on the infected remote host. Take control of remote shutdown and reboot of host. Disable infected computer remote pointer and keyboard input. Enter into shell of remote infected host with full control. Provide a list of all the active processes. Clear all existing SSDT of all existing hooks.
Indicators of Compromise 30
Domain app-microsoft-edge[.]com[.]cn Domain baidu-pan[.]com[.]cn Domain calibre-ebook[.]com[.]cn Domain cn-drawio[.]com[.]cn Domain gehie246[.]com Domain gw-sogou[.]com[.]cn Domain iualef[.]net Domain kaspersky-lab[.]hl[.]cn Domain mindmoster[.]com[.]cn Domain ocam-pc[.]com[.]cn Domain oijfwe[.]net Domain pc-razerzone[.]com[.]cn Domain sejda[.]hl[.]cn Domain steelseries-cn[.]com[.]cn Domain translate-youdao[.]hl[.]cn Domain zh-diskgenius[.]com[.]cn Filename BootRepair.sys Filename ConvertToPDF.exe Filename EnPortv.sys Filename Google Chrome Filename Google Chrome.exe Filename Microsoft Teams Filename Microsoft Teams.exe Filename PDFCORE8.dll Filename PDFDirect.exe Filename a_instapp83353001.exe Filename ainst8663586104.exe Filename update.log Filename wsftprm.sys IP 43[.]128[.]26[.]132
MITRE ATT&CK TTPs 33
T1005 T1021 T1021.006 T1027 T1036 T1036.005 T1053.005 T1055 T1055.012 T1055.015 T1059 T1059.001 T1059.003 T1070.003 T1071 T1071.001 T1078 T1082 T1085 T1112 T1113 T1133 T1134.001 T1190 T1204.002 T1213 T1213.001 T1484.002 T1543.001 T1548 T1548.002 T1566 T1566.001
Data from Local System
Collection
Remote Services
Lateral Movement
Windows Remote Management
Lateral Movement
Obfuscated Files or Information
Defense Evasion
Masquerading
Defense Evasion
Match Legitimate Name or Location
Defense Evasion
Scheduled Task
Execution
Process Injection
Defense Evasion
Process Hollowing
Defense Evasion
ListPlanting
Defense Evasion
Command and Scripting Interpreter
Execution
PowerShell
Execution
Windows Command Shell
Execution
Clear Command History
Defense Evasion
Application Layer Protocol
Command And Control
Web Protocols
Command And Control
Valid Accounts
Defense Evasion
System Information Discovery
Discovery
T1085
Modify Registry
Defense Evasion
Screen Capture
Collection
External Remote Services
Persistence
Token Impersonation/Theft
Defense Evasion
Exploit Public-Facing Application
Initial Access
Malicious File
Execution
Data from Information Repositories
Collection
Confluence
Collection
Trust Modification
Defense Evasion
Launch Agent
Persistence
Abuse Elevation Control Mechanism
Privilege Escalation
Bypass User Account Control
Privilege Escalation
Phishing
Initial Access
Spearphishing Attachment
Initial Access
Source Articles
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
A malware campaign attributed to the Chinese threat cluster Silver Fox (aka Yinhu) is distributing malicious fake software installers through spoofed vendor websites, primarily targeting Chinese-speaking users and multinational organizations in China. The installers deploy Gh0st RAT and ValleyRAT, which disable Windows Update services, weaken Microsoft Defender, and establish command-and-control communication via non-standard ports. The payloads use DLL sideloading and masquerade as legitimate installers to bypass security controls, enabling keystroke logging, clipboard theft, and remote system control.
hacker-news ·3h ago
SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT
The Chinese cybercrime group SilverFox targeted a Japanese industrial manufacturing organization using a sophisticated attack chain involving a three-driver BYOVD (Bring Your Own Vulnerable Driver) technique for kernel-level access and defense evasion. The attack began with a phishing email containing an invoice-themed lure, leading to DLL side-loading via malicious ZIP archives that deploy ValleyRAT, a Gh0st RAT variant. The malware uses multiple persistence and recovery mechanisms, including NTDLL unhooking, process injection, and a dual watchdog system to maintain remote access and resist removal.
hacker-news ·4w ago
GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft
A threat actor cluster known as CylindricalCanine, linked to the broader GoldenEyeDog (APT-Q-27) group, was responsible for a breach at DigiCert in April 2026. The attackers compromised support analysts via a malicious .scr file delivered through a customer support chat, gaining access to initialization codes and stealing code-signing certificates. These certificates were then used to sign malware, including Zhong Stealer and Golden Gh0st RAT, enabling evasion of security detection. The group primarily targets finance organizations in the Asia-Pacific region using phishing and DLL side-loading techniques.
hacker-news ·1mo ago
New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic
The China-linked threat actor Silver Fox has been linked to a new Rust-based remote access trojan (RAT) named MODBEACON. This malware leverages gRPC streaming and reuses transport layers from the open-source Xray/V2Ray framework for encrypted command-and-control (C2) communications. It targets technology, education, and state-owned enterprises in Asia via counterfeit software installers distributed through SEO poisoning, enabling long-term access with capabilities including plugin loading, persistence, and data exfiltration.
hacker-news ·1mo ago