GhostEmperor

GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets.

Qrupun mənşəyi Çin kimi bildirilir.

Qrup 1 zərərli proqram ailəsi ilə əlaqələndirilib.

Digər adları: FamousSparrow, UNC2286, Salt Typhoon, RedMike, OPERATOR PANDA

Qrup 1 zərərli proqram ailəsi ilə əlaqələndirilib.

Bu aktor haqqında dərc edilmiş hesabatlar:

• https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/
• https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf
• https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/

Mənbə: MISP Galaxy, Malpedia.