Loading malware…
SugarGh0st RAT is a Windows remote access trojan used to provide attackers with interactive control over compromised systems. Reported functionality includes executing arbitrary commands, capturing screenshots, and exfiltrating data from infected hosts. The malware has been associated with SweetSpecter, a suspected China-based espionage actor that emerged publicly in 2023 and has been linked to targeting government and political entities across the Middle East, Africa, and Asia, as well as attempted targeting of a U.S.-based AI company.
Observed delivery involved spear-phishing emails masquerading as support-related correspondence and carrying a malicious compressed attachment. The infection chain used a shortcut file as a lure mechanism, displaying a decoy document while decrypting and launching SugarGh0st RAT in the background on the victim machine. This tradecraft indicates a focus on social engineering and covert execution to establish unauthorized remote access while minimizing immediate user suspicion.
SugarGh0st RAT fits an espionage-oriented intrusion model centered on post-compromise control and collection. Its documented use supports command execution, surveillance through screen capture, and theft of victim data, making it suitable for follow-on operator-driven activity after initial access. High-confidence reporting ties its deployment to unsuccessful spear-phishing attempts by SweetSpecter against employee targets, reinforcing its role as an operational payload in targeted intrusion campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In the background, however, Windows malware known as SugarGh0st RAT would be decrypted and executed. The malware is designed to give SweetSpecter control over the compromised machine and allow them to do things like execute arbitrary commands, take screenshots, and exfiltrate data.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan (RAT) used for cyber-espionage, providing persistent backdoor access to compromised systems.
Remote access trojan (RAT) used for persistent access and control of compromised systems.
A remote access trojan used in the SweetSpecter spear-phishing campaign. It is delivered via a malicious ZIP/LNK attachment, then decrypted and executed to provide control of the compromised Windows machine, including arbitrary command execution, screenshot capture, and data exfiltration.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.