Loading malware…
GhostNet was a large-scale cyber-espionage operation employing backdoor malware to compromise systems belonging to Tibetan organizations, foreign ministries, embassies, and other governmental or diplomatic entities. Disclosed in 2009, the operation was reported to have compromised 1,295 computers across 103 countries; its investigation began after suspected compromises affecting the Office of the Dalai Lama. The operation enabled remote surveillance and collection of sensitive files, including covert activation of webcams and audio inputs. Its infrastructure was largely traced to servers in China, although this did not establish direct Chinese government involvement. Windows backdoor samples associated with GhostNet activity have also been identified.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced solely as the purportedly linked infrastructure associated with GhostCode's device enrolment activity.
A cyber-espionage network uncovered after sensitive files were exfiltrated from Tibetan government computers; it was largely traced to Chinese servers.
Targeted cyber-espionage malware operation historically used to spy on Tibetan organizations and many government offices globally (as referenced for historical context).
Named espionage malware/network discussed alongside Ghost RAT in GhostNet investigation.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.