Loading malware…
Gh0stTimes is a customized remote-access malware family used by the China-linked espionage group BlackTech, also tracked as Earth Hundun, Palmerworm, Circuit Panda, and BRONZE CANAL. It has been observed in attacks since at least 2020 and is derived from Gh0st RAT, retaining closely related file-management and shell functionality while introducing modified command-and-control communications and enhanced relay features.
The malware uses a custom protocol distinct from standard Gh0st RAT traffic. At session start, it authenticates to its command-and-control server using an identifier and keying material, after which traffic is encrypted with a session key. Command data is protected with a modified RC4 routine and compressed with zlib. Gh0stTimes collects basic host information such as hostname, username, and processor details and sends it to the operator.
Its supported functionality includes remote shell execution, file operations, command-controlled termination of communications, port mapping, and proxying. The port-mapping and proxy components are notable additions beyond the original Gh0st RAT design and indicate an emphasis on relay operations and covert access through compromised systems. Samples have also contained dummy code intended to complicate analysis. A dedicated operator panel known as Times has been associated with the malware.
Gh0stTimes has been linked to intrusions targeting Japanese organizations as part of broader BlackTech cyber-espionage activity affecting East Asia. BlackTech has historically targeted sectors including government, defense, telecommunications, media, academia, technology, manufacturing, and related strategic industries. In observed operations, Gh0stTimes has appeared alongside other BlackTech tooling and post-compromise utilities, consistent with long-term espionage and network access objectives.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BRONZE CANAL ... Tools ... Bifrose, Deuterbear, DRIGO, Flagpro, Gh0stTimes, KIVARS, PLEAD, Spiderpig, Waterbear, XBOW
This article introduces the details of the malware Gh0stTimes, which is used by this group. Gh0stTimes is customised based on Gh0st RAT and has been used in some attack cases since 2020.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
At the beginning of its communication with a C2 server, Gh0stTimes sends an authentication ID and data ... to generate an encryption key for the following communication. The C2 server checks the authentication ID and only accepts the communication with certain IDs.
PortmapManager (command number 0x32): C2 server redirect function UltraPortmapManager (command number 0x3F): Proxy function
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a tool used by the BRONZE CANAL threat profile.
Remote-access/backdoor malware used by BlackTech; code and functionality similar to Gh0stRAT and paired with a 'Times' panel.
A customized variant of Gh0st RAT used by BlackTech since 2020. It communicates with C2 servers over a custom protocol, performs host reconnaissance, supports file operations and remote shell execution, and adds enhanced relay/proxy capabilities via PortmapManager and UltraPortmapManager.
Mentioned as a previously reported BlackTech/Earth Hundun malware family.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.