MalwareUsed by 1 actor

ghost.js

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

DPRK

the final stage downloaded: ghost.js on Unix machines, or ghost.npl on Windows workstations ... The first thing we notice is the getSystemInfo() function, which sweeps the system for basic information such as the hostname, release name, platform, IP address, and MAC address. It then builds a string with that information and sends it to the C2 server to register the victim host.

via quetzal bitso blogquetzal.bitso.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.003Spearphishing via ServiceEvidence1

It made its way to us through an old classic excuse: a job offer targeting Alex, one of our developers. He played along with the fake job interview and, in the end, was given a repository as part of a coding challenge, which he then shared with us to investigate.

Execution

1 technique

T1059.007JavaScriptEvidence1

But let’s dig deeper into the final stage downloaded: ghost.js on Unix machines, or ghost.npl on Windows workstations...

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Oh no! The code is heavily obfuscated... they’re using the same obfuscation technique they’ve been using for the last three years.

T1036MasqueradingEvidence1

The infection starts with the “setup” file, which acts as a stager and differs between Windows (PowerShell) and Unix / macOS (Bash script). It creates a hidden folder to camouflage the downloaded binaries as if they were associated with Visual Studio Code.

T1140Deobfuscate/Decode Files or InformationEvidence1

Luckily, decoding Base64 is trivial... One of the strings reveals the C2 server address and endpoint, while the second translates to “now it time to get everything” (sic) which is used as a key to “speak” to the C2 server.

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence1

With a few bash lines, we could simulate a series of requests to the C2 server, making it believe that a new victim had been registered multiple times per second... making their server believe that a new victim called “QuetzalTeam” has been registered.

T1082System Information DiscoveryEvidence1

The first thing we notice is the getSystemInfo() function, which sweeps the system for basic information such as the hostname, release name, platform, IP address, and MAC address.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

One of the strings reveals the C2 server address and endpoint... It then builds a string with that information and sends it to the C2 server to register the victim host.

T1071.001Web ProtocolsEvidence1

One of the strings reveals the C2 server address and endpoint... URL:http[:]//141.94.148.39[:]1224 URL:http[:]//141.94.148.39[:]1224/api/checkStatus

T1105Ingress Tool TransferEvidence1

It downloads the vscode-bootstrap script (.ps1 or .sh, depending on the target system) into the fake .vscode folder. These scripts act as the next stage... and finally downloading the real villain of this story: the malware itself.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

quetzal bitso blogNews

Aug 21, 2026

North Korea’s Crypt: Hunting Ghosts

A newly observed JavaScript-based final-stage malware delivered via a fake coding challenge/job interview chain. It is dropped after platform-specific stagers and bootstrap scripts, performs host reconnaissance, registers the victim with a C2 server, and communicates using a hardcoded key and endpoint. The sample was heavily obfuscated but deobfuscated cleanly.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

ghost.js

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

DPRK

via quetzal bitso blogquetzal.bitso.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.003Spearphishing via ServiceEvidence1

Execution

1 technique

T1059.007JavaScriptEvidence1

But let’s dig deeper into the final stage downloaded: ghost.js on Unix machines, or ghost.npl on Windows workstations...

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Oh no! The code is heavily obfuscated... they’re using the same obfuscation technique they’ve been using for the last three years.

T1036MasqueradingEvidence1

T1140Deobfuscate/Decode Files or InformationEvidence1

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence1

T1082System Information DiscoveryEvidence1

The first thing we notice is the getSystemInfo() function, which sweeps the system for basic information such as the hostname, release name, platform, IP address, and MAC address.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

One of the strings reveals the C2 server address and endpoint... It then builds a string with that information and sends it to the C2 server to register the victim host.

T1071.001Web ProtocolsEvidence1

One of the strings reveals the C2 server address and endpoint... URL:http[:]//141.94.148.39[:]1224 URL:http[:]//141.94.148.39[:]1224/api/checkStatus

T1105Ingress Tool TransferEvidence1

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

quetzal bitso blogNews

Aug 21, 2026

North Korea’s Crypt: Hunting Ghosts

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.