GhostEmperor
GhostEmperor is classified as state-sponsored.
- Malware families
- 1
- Origin
- China
- Also known as
- 5
GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets.
The group's reported origin is China.
The group is associated with 1 malware families.
Also known as: FamousSparrow, UNC2286, Salt Typhoon, RedMike, OPERATOR PANDA
The group is associated with 1 malware families.
Malware families
- SparrowDoor
Published reports on this actor:
- https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf
- https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.