MalwareUsed by 1 actor

SugarGh0st RAT

SugarGh0st RAT is a Windows remote-access trojan used by the suspected China-based threat actor SweetSpecter. It has been delivered through spear-phishing emails containing ZIP archives that use an LNK-file lure displaying a decoy document while decrypting and executing the malware in the background. SugarGh0st RAT enables operators to control compromised systems, execute arbitrary commands, capture screenshots, and exfiltrate data. SweetSpecter used this delivery chain in attempted targeting of OpenAI employees and has been associated with cyber-espionage activity against government and political entities in Asia, Africa, and the Middle East.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

SweetSpecter

SweetSpecter also targeted OpenAI employees with spear-phishing messages carrying SugarGh0st RAT.

via polyswarmblog.polyswarm.io

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587.001MalwareEvidence1

APT41 ... used Gemini to assist with C++ and Golang development for multiple tools, including an actor-developed command-and-control framework.

Initial Access

2 techniques

T1566PhishingEvidence3

The operation used disposable hosting alongside phishing, ClickFix, and DNS hijacking, while AI-enabled workflows researched and registered domains, configured hosting, and sent phishing material.

T1566.001Spearphishing AttachmentEvidence1

The emails included a malicious attachment called “some problems.zip”, containing an LNK file.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

The malware is designed to give SweetSpecter control over the compromised machine and allow them to do things like execute arbitrary commands

T1204.002Malicious FileEvidence1

This file contained code that would, if opened, present a DOCX file to the user... In the background, however, Windows malware known as SugarGh0st RAT would be decrypted and executed.

Persistence

1 technique

T1547.009Shortcut ModificationEvidence1

The emails included a malicious attachment called “some problems.zip”, containing an LNK file.

Privilege Escalation

1 technique

T1547.009Shortcut ModificationEvidence1

The emails included a malicious attachment called “some problems.zip”, containing an LNK file.

Collection

1 technique

T1113Screen CaptureEvidence1

The malware is designed to give SweetSpecter control over the compromised machine and allow them to do things like execute arbitrary commands, take screenshots, and exfiltrate data.

Command and Control

1 technique

T1219Remote Access ToolsEvidence1

It has also been observed conducting unsuccessful spear-phishing attempts against OpenAI employees to deliver the SugarGh0st RAT.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

polyswarmNews

Sep 21, 2026

China and the Cyber Arms Race for AI Supremacy

A remote-access trojan delivered through spear-phishing messages targeting OpenAI employees in the reported SweetSpecter activity.

bleeping computerNews

Oct 12, 2024

OpenAI confirms threat actors use ChatGPT to write malware

Remote access trojan (RAT) used for cyber-espionage, providing persistent backdoor access to compromised systems.

the hacker newsNews

Oct 10, 2024

OpenAI Blocks 20 Global Malicious Campaigns Using AI for Cybercrime and Disinformation

Remote access trojan (RAT) used for persistent access and control of compromised systems.

openai blogNews

Oct 1, 2024

SweetSpecter: China-linked cyber activity | OpenAI

A remote access trojan used in the SweetSpecter spear-phishing campaign. It is delivered via a malicious ZIP/LNK attachment, then decrypted and executed to provide control of the compromised Windows machine, including arbitrary command execution, screenshot capture, and data exfiltration.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SugarGh0st RAT