Chinese-Speaking Threat Actors Spread Gh0st RAT via Trojanized Software Installers

Multiple security firms reported ongoing campaigns targeting Chinese-speaking Windows users with fake or trojanized installers for popular software, including Google Chrome, Microsoft Teams, Surfshark, Signal, Telegram, Zoom, DeepSeek, Quark Cloud, and activation tools. The attacks rely on spoofed download sites and malicious MSI or NSIS packages that decrypt payloads in memory and ultimately deploy remote-access malware tied to the Gh0st RAT ecosystem, including modified Gh0st variants and Atlas RAT. Researchers linked the activity to Chinese-speaking threat actors including Dragon Breath and Silver Fox, noting refreshed infrastructure, low detection rates, and lures designed to appear legitimate, in some cases using AI-generated web pages and valid code-signing certificates.

The intrusion chains emphasize defense evasion before full payload delivery. Reported techniques include abuse of signed or vulnerable kernel drivers to terminate or disable more than 200 security products, unsigned WDAC policies to block Chinese antivirus tools, Protected Process Light abuse to corrupt Microsoft Defender's MsMpEng.exe, phantom DLL side-loading, thread-pool-based process injection, in-memory reflective loading, and persistence through services, scheduled tasks, and watchdog scripts. Once installed, the malware supports encrypted command-and-control, command execution, keylogging, clipboard theft, active-window logging, RDP session hijacking, and additional payload delivery, underscoring a sustained pattern of installer-based malware operations aimed at users seeking trusted software from unofficial sources.