Loading malware…
SugarGh0st is a remote access trojan (RAT) observed in spear-phishing campaigns. The provided content states that suspected China-based threat actor SweetSpecter used spear-phishing emails sent to OpenAI employees’ personal email addresses, with malicious ZIP attachments disguised as support requests; opening the attachments triggered an infection chain that dropped SugarGh0st RAT on the victim system. The malware is also described as being used by SneakyChef in campaigns targeting government entities in Asia and EMEA. Based on the content, SugarGh0st is associated with espionage-oriented activity and government targeting. High-confidence infection vector details are limited to phishing emails carrying ZIP attachments that lead to the RAT being dropped. No specific technical capabilities beyond its identification as a RAT, and no concrete IOCs such as hashes, domains, or filenames for SugarGh0st itself, are provided in the content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
SweetSpecter, a suspected China-based adversary ... has also been observed conducting unsuccessful spear-phishing attempts against OpenAI employees to deliver the SugarGh0st RAT.
“…SneakyChef, targeted government entities in Asia and EMEA with SugarGh0st malware…” | ...SneakyChef, targeted government entities in Asia and EMEA with SugarGh0st malware...
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan dropped via spear-phishing ZIP attachments as part of an infection chain attributed to the SweetSpecter cluster.
A remote access trojan used in spear-phishing attempts to gain access to victim systems.
Malware used in campaigns attributed to the China-aligned actor SneakyChef, targeting government entities in Asia and EMEA.
Malware used by the China-aligned actor SneakyChef against government entities in Asia and EMEA.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.