Cyber threats / Threat actors

GhostEmperor

CN Suspected sponsor: China · ATT&CK G1045
0
APAC targets
58
Techniques
1
Incidents
2
News · 30d
Profile
Also known as: FamousSparrow, OPERATOR PANDA, RedMike, Salt Typhoon, UNC2286

GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets.

ATT&CK techniques · 58
Reconnaissance
Resource Development
Initial Access
Execution
Persistence
Privilege Escalation
Stealth
Defense Impairment
Credential Access
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Incidents attributed
In the news · last mention Nov 10
Targets
No victim countries in the sources.
Relevance to the EU
EU relevance: Low
No EU member state among its known victims and no overlap with EU projects
No EU cooperation projects recorded in its target countries.
References
Sources: MISP, MITRE