Global Gh0st RAT Malware Campaigns via Software Impersonation and RONINGLOADER Loader

Security researchers have uncovered two major global malware campaigns that deliver the Gh0st RAT remote access trojan through large-scale software impersonation tactics. Attackers use trojanized installers mimicking legitimate applications such as Microsoft Teams and Google Chrome to distribute the RONINGLOADER loader, which in turn deploys an updated version of Gh0st RAT. The campaigns primarily target Chinese-speaking users and employ advanced evasion techniques, including DLL injection, removal of userland hooks, and anti-virus termination, to maintain persistence and avoid detection.

The updated Gh0st RAT malware enables attackers to execute commands, manipulate Windows Registry keys, capture clipboard data, inject shell code, and log keystrokes and window titles. These campaigns highlight the increasing sophistication of threat actors in leveraging multi-stage loaders and social engineering to compromise victims at scale. The findings are supported by analyses from both Palo Alto Networks Unit 42 and Elastic Security Labs, emphasizing the need for heightened vigilance against software impersonation and loader-based malware delivery.