GhostNet
GhostNet is a cyber-espionage group/operation publicly reported in 2009. The provided content states that GhostNet used Gh0st RAT to target diplomatic, political, economic, and military entities worldwide. It is described as a surveillance ring believed to be operating from China, though the content does not provide definitive attribution to the Chinese state. The content further states that GhostNet stole documents from the Dalai Lama and from entities in more than 103 countries. Researchers later distinguished a separate espionage operation, Shadow Network, from the earlier GhostNet activity, noting that GhostNet was the earlier campaign. No additional aliases or sub-groups are provided in the content beyond the name GhostNet itself.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Military
Tradecraft
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cyber-espionage group historically noted for using Gh0st RAT against diplomatic, political, economic, and military targets worldwide.
GhostNet appears only in a generic Wikipedia navigation list of hacking groups, without any discussion tying it to the PoisonIvy content.
Groups Anonymous associated events Avalanche Crime Boys GNAA Goatse Security Insanity Zine Corp. GhostNet Level Seven PLA Unit 61398 Prime Suspectz RBN ShadowCrew World of Hell Sandworm
Groups Anonymous associated events Avalanche Crime Boys GNAA Goatse Security Insanity Zine Corp. GhostNet Level Seven PLA Unit 61398 Prime Suspectz RBN ShadowCrew World of Hell Sandworm
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.