Ghostcontainer APT

GhostContainer is a suspected advanced persistent threat activity cluster associated with intrusions against government entities in Asia through exploitation of Microsoft Exchange Server. The operation is characterized by deployment of the bespoke GhostContainer backdoor, a modular post-exploitation framework designed to provide full control over compromised Exchange servers while minimizing reliance on conventional command-and-control infrastructure. Operators are assessed to connect directly to infected servers through Exchange web requests, an approach that supports stealth and complicates network-based detection. GhostContainer supports execution of shellcode and system commands, file download and file manipulation, and loading of additional .NET bytecode modules. Reported modules include web proxying and tunneling components, indicating an emphasis on covert operator access and flexible post-compromise operations. The malware’s modular architecture and the operators’ ability to adapt public code into an espionage-capable toolset indicate a skilled intrusion set focused on long-term access and operational concealment. The activity has been linked to targeting of high-value organizations, specifically government entities in Asia, and is consistent with espionage-oriented objectives rather than financially motivated crime. No high-confidence country-of-origin attribution is currently available from the supplied facts.