Loading story…
Palo Alto Networks reported a multi-year intrusion campaign dubbed Musical Chairs that deployed a new variant of the Gh0st remote access trojan across targeted environments. The operation was notable for its longevity and for adapting the well-known Gh0st malware family into a customized toolset that enabled persistent access, remote control, and continued activity inside victim networks.
The reporting indicates the campaign was tracked over several years and tied together by shared malware characteristics and operational patterns, showing a sustained espionage-style effort rather than isolated infections. By highlighting a newly observed Gh0st variant within a broader, long-running operation, the research underscored the continued threat posed by modified legacy RATs that remain effective for stealthy compromise and persistence.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks published research describing 'Musical Chairs,' a multi-year campaign involving a new variant of Gh0st malware. The references provided do not include additional dated milestones beyond the public disclosure of the campaign.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have uncovered two major global malware campaigns that deliver the Gh0st RAT remote access trojan through large-scale software impersonation tactics. Attackers use trojanized installers mimicking legitimate applications such as Microsoft Teams and Google Chrome to distribute the RONINGLOADER loader, which in turn deploys an updated version of Gh0st RAT. The campaigns primarily target Chinese-speaking users and employ advanced evasion techniques, including DLL injection, removal of userland hooks, and anti-virus termination, to maintain persistence and avoid detection. The updated Gh0st RAT malware enables attackers to execute commands, manipulate Windows Registry keys, capture clipboard data, inject shell code, and log keystrokes and window titles. These campaigns highlight the increasing sophistication of threat actors in leveraging multi-stage loaders and social engineering to compromise victims at scale. The findings are supported by analyses from both Palo Alto Networks Unit 42 and Elastic Security Labs, emphasizing the need for heightened vigilance against software impersonation and loader-based malware delivery.
Jun 29, 2026
Multiple security firms reported ongoing campaigns targeting Chinese-speaking Windows users with fake or trojanized installers for popular software, including **Google Chrome**, **Microsoft Teams**, **Surfshark**, **Signal**, **Telegram**, **Zoom**, **DeepSeek**, **Quark Cloud**, and activation tools. The attacks rely on spoofed download sites and malicious `MSI` or `NSIS` packages that decrypt payloads in memory and ultimately deploy remote-access malware tied to the **Gh0st RAT** ecosystem, including modified Gh0st variants and **Atlas RAT**. Researchers linked the activity to Chinese-speaking threat actors including **Dragon Breath** and **Silver Fox**, noting refreshed infrastructure, low detection rates, and lures designed to appear legitimate, in some cases using AI-generated web pages and valid code-signing certificates. The intrusion chains emphasize defense evasion before full payload delivery. Reported techniques include abuse of signed or vulnerable kernel drivers to terminate or disable more than 200 security products, unsigned `WDAC` policies to block Chinese antivirus tools, **Protected Process Light** abuse to corrupt **Microsoft Defender**'s `MsMpEng.exe`, phantom DLL side-loading, thread-pool-based process injection, in-memory reflective loading, and persistence through services, scheduled tasks, and watchdog scripts. Once installed, the malware supports encrypted command-and-control, command execution, keylogging, clipboard theft, active-window logging, RDP session hijacking, and additional payload delivery, underscoring a sustained pattern of installer-based malware operations aimed at users seeking trusted software from unofficial sources.
Aug 14, 2026
Sophos X-Ops reported that a phishing campaign tracked as **STAC6405** used invitation-themed lures to trick targets into installing legitimate remote monitoring and management tools, including **LogMeIn Resolve** and **ScreenConnect**, giving attackers unattended remote access. The activity was first observed in April 2025, peaked in October and November 2025, and affected more than 80 organizations, primarily in the United States. Sophos said some phishing links were still active at the time of reporting, indicating the campaign may still be ongoing. In most intrusions, the attackers stopped after establishing remote access, suggesting the operation may support initial access brokerage or maintain dormant persistence for later use. In two cases, however, the compromise advanced to second-stage activity: one intrusion deployed a **HeartCrypt**-packed infostealer that hid the mouse cursor, injected into `csc.exe`, contacted `45[.]56.162.138`, and stole browser, wallet, and system data; another used a ScreenConnect-based payload bundled with Java components and a likely **SimpleHelp**-related remote access binary to obtain interactive access before defenders contained the incident.
Jun 29, 2026