GhostEmperor

Also known as FamousSparrow, UNC2286, Salt Typhoon, RedMike, OPERATOR PANDA

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1005 Data from Local System T1016 System Network Configuration Discovery T1018 Remote System Discovery T1020.001 Traffic Duplication T1021.001 Remote Desktop Protocol T1021.004 SSH T1027.010 Command Obfuscation T1040 Network Sniffing T1046 Network Service Discovery T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1059.004 Unix Shell T1059.006 Python T1059.008 Network Device CLI T1059.013 Container CLI/API T1070.003 Clear Command History T1070.007 Clear Network Connection History and Configurations T1070.009 Clear Persistence T1071.001 Web Protocols T1071.002 File Transfer Protocols T1072 Software Deployment Tools T1078 Valid Accounts T1082 System Information Discovery T1090 Proxy T1090.003 Multi-hop Proxy T1095 Non-Application Layer Protocol T1098.004 SSH Authorized Keys T1105 Ingress Tool Transfer T1110.001 Password Guessing T1110.002 Password Cracking T1132.001 Standard Encoding T1136 Create Account T1136.001 Local Account T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1543.005 Container Service T1548.003 Sudo and Sudo Caching T1552.001 Credentials In Files T1556 Modify Authentication Process T1569 System Services T1571 Non-Standard Port T1572 Protocol Tunneling T1583.003 Virtual Private Server T1584.008 Network Devices T1585.001 Social Media Accounts T1587 Develop Capabilities T1587.001 Malware T1588.002 Tool T1588.005 Exploits T1590.004 Network Topology T1595 Active Scanning T1599 Network Boundary Bridging T1602.001 SNMP (MIB Dump)T1602.002 Network Device Configuration Dump T1610 Deploy Container T1685 Disable or Modify Tools T1685.006 Clear Linux or Mac System Logs T1686 Disable or Modify System Firewall T1686.002 Network Device Firewall

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.