Skip to content

gh0st RAT

Software · ATTACK:enterprise:S0032

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0032",
  "title": "gh0st RAT",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0032",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--88c621a7-aef9-4ae0-94e3-1fc87123eb24",
  "external_id": "S0032",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:24.937Z",
  "modified": "2026-05-12T15:12:00.737Z",
  "version": "3.3",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "gh0st RAT"
    },
    {
      "source_name": "Mydoor"
    },
    {
      "source_name": "Moudoor"
    },
    {
      "source_name": "FireEye Hacking Team",
      "url": "https://www.fireeye.com/blog/threat-research/2015/07/demonstrating_hustle.html"
    },
    {
      "source_name": "Novetta-Axiom",
      "url": "https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"
    },
    {
      "source_name": "Nccgroup Gh0st April 2018",
      "url": "https://research.nccgroup.com/2018/04/17/decoding-network-data-from-a-gh0st-rat-variant/"
    },
    {
      "source_name": "Arbor Musical Chairs Feb 2018",
      "url": "https://www.arbornetworks.com/blog/asert/musical-chairs-playing-tetris/"
    }
  ]
}

Explicit source assertions (36)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02d4ee3d-adb9-49fc-8e91-3379c508692b

Gh0stRAT ATT March 2019

ATTACK:enterprise:G0062 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d432cda-9684-4daa-a66f-c65ad90ff2b7

Proofpoint TA459 April 2017

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f4c2cab-c3ca-4f31-8557-485248b65761

Gh0stRAT ATT March 2019

ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c9d5795-fa0d-4d01-815f-eef0e4d8b2b7

Cylance Dust Storm

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33a382a9-ebb3-48d9-bb7e-394a27783668

Nccgroup Gh0st April 2018 · Gh0stRAT ATT March 2019

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37e520de-fe38-450b-a30e-3372f7ff3a4f

FireEye APT41 Aug 2019

ATTACK:enterprise:G0011 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f780c76-b5d5-43f9-b4f2-048106f00894

Bizeul 2014 · Villeneuve 2014

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41735c38-950d-4c69-8c01-c076d3a4e409

FireEye Hacking Team · Gh0stRAT ATT March 2019

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f8411e1-71c2-46da-a789-9403c4b1f967

Cisco Group 72 · Novetta-Axiom

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5291c077-dc09-4716-ab9a-d65318794839

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a771636-9b4d-423c-b7ba-1f274cbfb5b7

Arbor Musical Chairs Feb 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d1d76e6-ecd8-44e7-bc90-7701788dc28e

Secureworks BRONZEUNION Feb 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6397d645-207c-4d1b-9a65-5f1b69a84e7c

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6874b50a-10e8-4036-bb2d-aabab35ec75b

Arbor Musical Chairs Feb 2018

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68852bf2-c3cf-4d59-b1c1-f6af8fb61be6

FireEye Hacking Team · Nccgroup Gh0st April 2018

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--764fd9f6-ea24-42fd-b289-dc03d688bb62

Mandiant APT43 March 2024

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a705189-ab75-428c-ae52-b70bc0d17624

CISA AA21-200A APT40 July 2021

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80c071f7-123e-468f-800d-726a1d3e4144

RSA2017 Detect and Respond Adair

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80d8e746-f0a0-4781-824a-0147dbbee072

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8631491d-bda8-4eee-93ec-5f3fc6340c3f

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8df1a464-9623-46bf-b23b-0430aa0a8c44

Nccgroup Gh0st April 2018

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f8adede-8b7a-460d-b852-b52328df178a

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9966a850-54b2-41f5-83de-51c066085d72

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a564f3da-349a-4e65-826c-8ca60bc920bf

FireEye Hacking Team

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9a71970-33d1-4336-acb3-9252b91d27a4

Nccgroup Gh0st April 2018 · Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab2b2cd2-9f20-4497-a6d3-ef1698809779

Nccgroup Gh0st April 2018 · Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aee29ae1-4544-4fc8-b30b-4717888991ca

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af883d09-3f26-4267-9081-4783447e3283

FireEye Hacking Team · Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0a40611-da3c-4447-b0af-fa66f927b623

Nccgroup Gh0st April 2018

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1568.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2876820-3402-45e3-a0af-f85237a23ae6

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--becf0a5e-4636-4d2f-bd4a-fd60b15ee74a

Alintanahin 2014 · Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c16854fa-add6-4be3-9547-05cc479861d8

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1573

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc2de45c-a1f3-4085-ac35-dffa8a86e9b3

Gh0stRAT ATT March 2019

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da2585bf-f31d-42c9-b488-e6cbab7bcd42

Malwarebytes Higaisa 2020

ATTACK:enterprise:G0138 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--daabfd4e-f873-4afc-8f39-fc5daf7cd71a

AhnLab Andariel Subgroup of Lazarus June 2018

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de0b8fd5-c974-41ab-965d-2bbd145e207f

Secureworks BRONZE FLEETWOOD Profile

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.