Malware

GhostRAT

GhOstRAT is a Windows-based remote access trojan (RAT). The provided content states that a "GhostRAT Loader" downloads and executes GhOstRAT on Windows, launches multiple background processes, deploys additional components as part of a staged infection chain, alters system configurations for persistence across reboots, and communicates with external servers to enable remote command execution or data exchange. The malware was reported as being deployed via exploitation of CVE-2024-23692, an unauthenticated remote code execution vulnerability in Rejetto HTTP File Server (HFS) 2.4.0 RC7 and 2.3m; ASEC observed attackers exploiting vulnerable HFS servers to install RATs including GhOstRAT for persistence. The content also notes a separate case in which China-linked hackers weaponized the Nezha RMM tool to deploy GhostRAT. A CYFIRMA YARA rule titled "Suspicious_Malware_Indicator_GhostRAT" is associated with a sample hash: b0521ad45fd21cdae26afdc74307870c5859421e049bbff2a545852b0ccf0fe6.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

“The following are the TTPs… Execution T1059 Command and Scripting Interpreter” (GhostRAT Loader section).

T1129Shared ModulesEvidence1

“Execution T1129 Shared Modules” (listed for Ndm448 and also for GhostRAT Loader).

Persistence

2 techniques

T1112Modify RegistryEvidence1

“Persistence T1112 Modify Registry” (GhostRAT Loader list) and also listed multiple times in UNC3886 TTPs.

T1547Boot or Logon Autostart ExecutionEvidence1

“Persistence T1547 Boot or Logon Autostart Execution” (GhostRAT Loader list).

Privilege Escalation

2 techniques

T1134Access Token ManipulationEvidence1

“Privilege Escalation T1134 Access Token Manipulation” (GhostRAT Loader list) and narrative: “attempting to gain elevated privileges through manipulation of access tokens.”

T1547Boot or Logon Autostart ExecutionEvidence1

“Persistence T1547 Boot or Logon Autostart Execution” (GhostRAT Loader list).

Stealth

2 techniques

T1027.002Software PackingEvidence1

“Defense Evasion T1027.002 Obfuscated Files or Information: Software Packing” (Ndm448 list) and “Defense Evasion… T1027 Obfuscated Files or Information” (GhostRAT Loader list).

T1134Access Token ManipulationEvidence1

“Privilege Escalation T1134 Access Token Manipulation” (GhostRAT Loader list) and narrative: “attempting to gain elevated privileges through manipulation of access tokens.”

Defense Impairment

2 techniques

T1112Modify RegistryEvidence1

“Persistence T1112 Modify Registry” (GhostRAT Loader list) and also listed multiple times in UNC3886 TTPs.

T1222File and Directory Permissions ModificationEvidence1

“Defense Evasion T1222 File and Directory Permissions Modification” (Ndm448 list) and “altering permissions” described in GhostRAT Loader method narrative.

Discovery

3 techniques

T1012Query RegistryEvidence1

Listed under Discovery for Ndm448 and GhostRAT Loader; also referenced in narrative: “interaction with extensive registry structures…”.

T1082System Information DiscoveryEvidence1

“Discovery T1082 System Information Discovery” (Ndm448 list; also GhostRAT Loader and UNC3886 lists).

T1083File and Directory DiscoveryEvidence1

“Discovery T1083 File and Directory Discovery” (Ndm448 list) and narrative describing rapid traversal of user/system directories prior to encryption.

Collection

2 techniques

T1115Clipboard DataEvidence1

“Collection T1115 Clipboard Data” (Ndm448 list) and “Collection T1115 Clipboard Data Collection” (GhostRAT Loader list).

T1125Video CaptureEvidence1

“Collection T1125 Video Capture” (GhostRAT Loader list).

Impact

1 technique

T1529System Shutdown/RebootEvidence1

“Impact T1529 System Shutdown/Reboot” (GhostRAT Loader list) and narrative: “can disrupt normal operations by forcing system restarts or shutdowns…”.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

cyfirma newsNews

Feb 20, 2026

Weekly Intelligence Report - 20 February 2026 - CYFIRMA

Windows remote access trojan delivered by GhostRAT Loader; described as enabling stealthy background operation, persistence across reboots, and external communications consistent with remote command execution and/or data exchange (supporting monitoring and information theft).

cso onlineNews

Oct 10, 2025

Open-source DFIR Velociraptor was abused in expanding ransomware efforts

Remote Access Trojan (RAT) deployed via weaponized Nezha RMM tool by China-linked threat actors.

belgium ccbNews

Jan 21, 2026

WARNING: ACTIVELY EXPLOITED REMOTE CODE EXECUTION VULNERABILITY IN HTTP FILE SERVER. | CCB Safeonweb

Remote access trojan reportedly deployed after exploitation of CVE-2024-23692 in Rejetto HFS to establish persistence on compromised systems.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

GhostRAT