GhostSocks

Malware actors were playing a fourth game: opportunistic distribution. Fake repositories dressed as leaked Claude Code delivered Vidar v18.7 and GhostSocks to anyone who downloaded them.

MITRE ATT&CK TTPs ... Resource Development Establish Accounts: Social Media Accounts T1585.003 Disposable GitHub accounts for distribution

MITRE ATT&CK Mapping Tactic – Technique – Sub-Technique Resource Development – T1588 - Malware

MITRE ATT&CK TTPs ... Resource Development Stage Capabilities: Upload Malware T1608.001 Malware hosted on GitHub Releases

Search engines increased the exposure of the malicious repository ... The repository’s llms.txt and topic taxonomy were designed to be discovered by both classical search engines and large-language-model-powered search.

For web searches such as “DeepSeek v4 weights GitHub,” the malicious repository and its forks were positioned among top results, at times appearing ahead of official references like the Hugging Face release page.

The widespread availability of the proprietary code has created a massive vector for supply chain attacks. Cybercriminals are now actively weaponizing this incident, creating malicious forks designed to compromise developer workstations.

MITRE ATT&CK TTPs ... Initial Access Phishing: Spearphishing Link T1566.002 Lure repositories with download links

Beyond routing attacker traffic through residential connections, it also includes a backdoor component that allows operators to run arbitrary commands and deploy additional malicious payloads on infected systems.

GhostSocks executes this command with PowerShell, which means defenders should be on the lookout for the above command string as it could be indicative of a GhostSocks infection.

Arbitrary Command Execution ( shell , ID: 5): Executes arbitrary commands sent by the C2: cmd.exe /C <command>

MITRE ATT&CK Mapping Technique Mapping Evidence T1106 Native API Native DLL loaded via Electron FFI.

MITRE ATT&CK Mapping Technique Mapping Evidence T1204 User Execution User installs/runs trojanized utility app.

MITRE ATT&CK TTPs ... Execution User Execution: Malicious File T1204.002 Victim executes trojanized dropper

Early variants of GhostSocks do not implement a persistence mechanism; however, later versions achieve persistence via registry run keys, ensuring sustained proxy operational time [1].

This mechanism, which can be viewed below and leverages registry run keys, allows for GhostSocks infections to survive restarts, allowing for a more long-lasting proxy uptime.

This mechanism, which can be viewed below and leverages registry run keys, allows for GhostSocks infections to survive restarts, allowing for a more long-lasting proxy uptime.

The above-mentioned GhostSocks sample is heavily obfuscated at points, likely making use of the popular open-source Go obfuscator Garble... Along with some features from Gofuscator such as inline XOR-based string deobfuscation.

MITRE ATT&CK Mapping Technique Mapping Evidence T1036 Masquerading Fake WinDirStat and LightShot apps.

the malware employs... an anti-sandboxing methodology utilising the GetCursorPos API

The configuration is then encoded into a JSON object, obfuscated, and written to %APPDATA%\config.

"...debugging messages... including invoking malware into memory... prior to running decrypted payloads"

Early variants of GhostSocks do not implement a persistence mechanism; however, later versions achieve persistence via registry run keys, ensuring sustained proxy operational time [1].

"...adding firewall rules..."

Using this feature, actors are able to easily leverage LummaC2’s “Google Expired Token Refresh” feature in conjunction with the residential proxies to refresh expired Google tokens, even when a victim has changed their password.

the malware employs... an anti-sandboxing methodology utilising the GetCursorPos API

After GhostSocks assembles its JSON configuration dictionary, it encrypts the dictionary with XOR using the key “config” and sends it to one of the C2s contained in its hardcoded C2 list in a basic request... While older samples communicate over HTTP, newer samples have been spotted leveraging HTTPS...

GhostSocks uses a fairly simple relay-based C2 implementation using a simple HTTP API... Upon a victim first connecting to the C2, GhostSocks starts to build the HTTP GET query parameters... and a X-Api-Key header required for all requests to the C2.

MITRE ATT&CK Mapping Technique Mapping Evidence T1090 Proxy Backconnect/proxy strings and yamux-based session code.

“GhostSocks backconnect proxy malware, designed to convert users' machines into a proxy node.”

GhostSocks... turns compromised systems into proxies. It allows threat actors to bypass anti-fraud or MFA checks when logging into accounts with credentials harvested by deployed information stealers

MITRE ATT&CK TTPs ... Command and Control Proxy: Multi-hop Proxy T1090.003 GhostSocks SOCKS5 proxy

Written in GoLang, GhostSocks utilizes the SOCKS5 proxy protocol, creating a SOCKS5 connection on infected devices. ... MITRE ATT&CK Mapping ... Command and Control – T1095 – Non-application Layer Protocol

MITRE ATT&CK Mapping Tactic – Technique – Sub-Technique ... Command and Control – T1102 – One-Way Communication

Download & Execute Arbitrary Executables ( update , ID: 6) Download an arbitrary executable, execute it using the same code used for the shell command

The configuration is then encoded into a JSON object, obfuscated, and written to %APPDATA%\config.

GhostSocks has the ability to change these C2s on the fly following the initial check-in... GhostSocks also has the ability to insert new IPs if a given IP is taken down, or if a bot is using outdated IPs, allowing for more resilience than a single hardcoded config.

MITRE ATT&CK Mapping Tactic – Technique – Sub-Technique ... Command and Control – T1571 – Non-Standard Port

MITRE ATT&CK Mapping Technique Mapping Evidence T1573 Encrypted Channel TLS and encrypted session strings.