Threat Actor 🇨🇳 China
GhostEmperor
Also known as: FamousSparrow · UNC2286 · Salt Typhoon · RedMike · OPERATOR PANDA
GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets.
Indicators of Compromise 44
Domain aar[.]gandhibludtric[.]com Domain mail[.]io Domain openmail[.]pro Domain tutamail[.]com Filename /bin/fgfm Filename 1.txt Filename 123.tar Filename 123.txt Filename DgApi.dll Filename Dialog.dat Filename DisplayDialog.exe Filename NortonLog.txt Filename WINMM.dll Filename attacker-cert3 Filename backdoor-ssh Filename dbindex.dat Filename fltLib.dll Filename helpdesk Filename imfsbDll.dll Filename imfsbSvc.exe Filename pdc.exe SHA-1 b5367820cd32640a2d5e4c3a3c1ceedbbb715be2 SHA-256 071e662fc5bc0e54bcfd49493467062570d0307dc46f0fb51a68239d281427c6 SHA-256 1f94ea00be79b1e4e8e0b7bbf2212f2373da1e13f92b4ca2e9e0ffc5f93e452b SHA-256 28a859046a43fc8a7a7453075130dd649eb2d1dd0ebf0abae5d575438a25ece9 SHA-256 568561d224ef29e5051233ab12d568242e95d911b08ce7f2c9bf2604255611a9 SHA-256 5b165b01f9a1395cae79e0f85b7a1c10dc089340cf4e7be48813ac2f8686ed61 SHA-256 6240e39475f04bfe55ab7cba8746bd08901d7678b1c7742334d56f2bc8620a35 SHA-256 6aecf805f72c9f35dadda98177f11ca6a36e8e7e4348d72eaf1a80a899aa6566 SHA-256 6c48a510642a1ba516dbc5effe3671524566b146e04d99ab7f4832f66b3f95aa SHA-256 7803ae7ba5d4e7d38e73745b3f321c2ca714f3141699d984322fa92e0ff037a1 SHA-256 7acf21677322ef2aa835b5836d3e4b8a6b78ae10aa29d6640885e933f83a4b01 SHA-256 7be8e37bc61005599e4e6817eb2a3a4a5519fded76cb8bf11d7296787c754d40 SHA-256 929e3fdd3068057632b52ecdfd575ab389390c852b2f4e65dc32f20c87521600 SHA-256 db15923c814a4b00ddb79f9c72f8546a44302ac2c66c7cc89a144cb2c2bb40fa SHA-256 dbdc1beeb5c72d7b505a9a6c31263fc900ea3330a59f08e574fd172f3596c1b8 SHA-256 e4ea34a7c2b51982a6c42c6367119f34bec9aeb9a60937836540035583a5b3bc SHA-256 e6c216cec379f418179a3f6a79df54dcf6e6e269a3ce3479fd7e6d4a15ac066e IP 1[.]2[.]3[.]4 IP 144[.]31[.]1[.]252 IP 156[.]244[.]28[.]153 IP 38[.]54[.]63[.]75 IP 8[.]8[.]8[.]8 IP 89[.]31[.]121[.]101
MITRE ATT&CK TTPs 23
T1003.001 T1021.001 T1055.001 T1059.001 T1071.001 T1078 T1078.002 T1087.002 T1095 T1098.002 T1105 T1110.001 T1136.001 T1190 T1210 T1499 T1543.001 T1556.004 T1558 T1566 T1571 T1574.001 T1665
LSASS Memory
Credential Access
Remote Desktop Protocol
Lateral Movement
Dynamic-link Library Injection
Defense Evasion
PowerShell
Execution
Web Protocols
Command And Control
Valid Accounts
Defense Evasion
Domain Accounts
Defense Evasion
Domain Account
Discovery
Non-Application Layer Protocol
Command And Control
Additional Email Delegate Permissions
Persistence
Ingress Tool Transfer
Command And Control
Password Guessing
Credential Access
Local Account
Persistence
Exploit Public-Facing Application
Initial Access
Exploitation of Remote Services
Lateral Movement
Endpoint Denial of Service
Impact
Launch Agent
Persistence
Network Device Authentication
Credential Access
Steal or Forge Kerberos Tickets
Credential Access
Phishing
Initial Access
Non-Standard Port
Command And Control
DLL Search Order Hijacking
Persistence
Hide Infrastructure
Command And Control
Source Articles
Salty Much: Darktrace’s take on a recent Salt Typhoon intrusion
Salt Typhoon, a China-linked advanced persistent threat (APT) group also known as Earth Estries or UNC2286, conducted a cyber espionage intrusion targeting a European telecommunications organization. The attack began with exploitation of CVE-2025-5777 in Citrix NetScaler Gateway appliances, followed by lateral movement and DLL sideloading using legitimate antivirus software to execute the SNAPPYBEE (Deed RAT) backdoor. Command-and-control communications were observed using suspicious domains and IPs, with activity detected and contained early by Darktrace’s AI-driven systems.
dark-trace
ToolShell Used to Compromise Telecoms Company in Middle East | SECURITY.COM
China-based threat actors exploited the ToolShell vulnerability (CVE-2025-53770) to compromise a telecoms company in the Middle East and multiple government agencies globally shortly after the patch was released in July 2025. The attackers deployed backdoors such as Zingdoor and ShadowPad, used DLL sideloading techniques, and leveraged tools like KrustyLoader and Sliver for post-exploitation. Activities indicate espionage motives, with credential theft and lateral movement observed across compromised networks.
security.com
Opening the Black Box: Agentless Threat Detection for Virtual Appliances
FortiGate virtual appliances are being actively targeted by multiple threat actors due to their internet-facing nature and elevated privileges. Attackers exploit vulnerabilities such as CVE-2026-24858, CVE-2024-55591, and CVE-2022-41328 to gain access, create backdoor accounts, manipulate certificates, and establish lateral movement. These activities are often obscured by log deletion and weak configurations, making detection difficult without agentless visibility.
wiz
New InfraTrust report reveals infrastructure flaws admins should patch first
The July 2026 InfraTrust Pulse report by Eclypsium highlights critical infrastructure vulnerabilities that administrators should prioritize, focusing on those that are actively exploited, remotely accessible, or unauthenticated. Key vendors affected include SonicWall, Fortinet, Dell, F5, Juniper, and NVIDIA, with flaws impacting network edge devices, data center infrastructure, and firmware components. Russian and Chinese state-sponsored actors are increasingly targeting such infrastructure, as seen in campaigns linked to Volt Typhoon and Salt Typhoon. The report emphasizes risk-based prioritization over CVSS scores alone, noting that internet-exposed flaws pose significant real-world threats even if their severity scores are lower.
bleeping-computer ·6d ago