Gh0st RAT (Remote Access Trojan) is a notorious piece of malware designed for Windows platforms that enables attackers to remotely control infected computers. First developed and released by the Chinese group C. Rufus Security Team in 2008, its open-source nature has allowed cybercriminals and nation-state actors worldwide to customize and deploy it in a wide range of cyber espionage and cybercrime campaigns.
Key Capabilities
• Full remote control of the infected device’s screen.
• Real-time and offline keystroke logging (keylogging).
• Access to the infected machine’s webcam and microphone for live audio/video surveillance.
• Downloading and executing files remotely.
• Remote shutdown and reboot of the system.
• Disabling user input (mouse and keyboard).
• Listing and managing running processes.
• Clearing event logs and removing system hooks for stealth.
• Establishing persistence by registering itself as a Windows service.
• Opening remote shells for command execution.
Infection and Operation
Gh0st RAT is typically delivered through phishing emails containing malicious attachments. Once executed, the malware uses a dropper to install its components:
• User-level DLL: Installed as a Windows service, it registers the infected machine with the attacker’s command-and-control (C2) server and awaits instructions.
• Kernel-level driver: Manipulates the Windows System Service Dispatch Table (SSDT) to facilitate stealth and privilege escalation.
• Dropper: Prepares the system and installs the malware using techniques like DLL side-loading.
Communication and Stealth
Gh0st RAT communicates with its C2 server using encrypted and compressed packets. Each packet typically starts with a five-character “magic word” (default: “Gh0st”), which helps identify the malware’s traffic. The malware often uses zlib compression and encrypts its communications to evade detection by security tools.
Historical and Ongoing Use
Gh0st RAT gained international attention in 2009 during the “GhostNet” cyber-espionage operation, which targeted government offices, embassies, and the Dalai Lama’s Tibetan exile centers. Since its source code was leaked, numerous variants have emerged, some with enhanced features and targeting capabilities. It remains active in cyber-espionage campaigns, often attributed to Chinese-speaking or China-based threat actors, but its open-source status means it is used by a wide range of groups globally.
Notable Features and Variants
• Persistence: Registers as a service to survive reboots.
• Rootkit capabilities: Some variants include rootkits to hide files, processes, and registry keys.
• Variants: Numerous customized versions exist, such as “SugarGh0st,” with additional reconnaissance and evasion features.
• Targeting: Used against government, diplomatic, financial, healthcare, and educational institutions.