RAT

Gh0st RAT

RAT 15 detections found

Also known as: Ghost RAT, Gh0stRAT, Mydoor, Moudoor

Gh0st RAT is a Windows remote access trojan whose source code, originally developed by the C. Rufus Security Team, was leaked publicly around 2008 and has since been adopted and customized by numerous China-linked and other espionage-focused threat actors. It provides remote shell access, keylogging, webcam/microphone capture, and full remote control over an encrypted, compressed C2 channel. Customized derivatives remain active today: Cisco Talos and Proofpoint have both tracked "SugarGh0st RAT," a modified Gh0st variant used since 2023 against government targets in Uzbekistan and South Korea and, in 2024, against U.S. artificial-intelligence researchers.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

gh0st RAT, Software S0032 — MITRE ATT&CK
New SugarGh0st RAT targets Uzbekistan government and South Korea — Cisco Talos
Security Brief: Artificial Sweetener: SugarGh0st RAT Used to Target American Artificial Intelligence Experts — Proofpoint

Detection rules

Source	Rule	Status	Updated
suricata	ET MALWARE Gh0st RAT Variant CNC Checkin Attempt	rev 1	2026-05-28
snort	ET TROJAN Gh0st RAT Variant CNC Checkin Attempt	rev 1	2026-05-28
splunk	Windows Routing and Remote Access Service Registry Key Change	production	2026-05-13
splunk	Windows Rundll32 with Non-Standard File Extension	production	2026-05-13
suricata	ET MALWARE [ANY.RUN] Possible Gh0stRat Checkin	rev 2	2024-03-14
snort	ET TROJAN [ANY.RUN] Win32/Gh0stRat Activity	rev 1	2023-12-28
suricata	ET MALWARE [ANY.RUN] Win32/Gh0stRat Activity	rev 1	2023-12-28
snort	ET TROJAN [ANY.RUN] Win32/Gh0stRat Keep-Alive	rev 1	2023-12-28
suricata	ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive	rev 1	2023-12-28
suricata	ET MALWARE Win32/Gh0stRat C2 Checkin	rev 1	2023-09-27
snort	ET TROJAN Win32/Gh0stRat C2 Checkin	rev 1	2023-09-27
snort	ET TROJAN [ANY.RUN] Possible Gh0stRat Checkin	rev 1	2023-06-26
suricata	ET MALWARE Gh0st RAT Backdoor Checkin	rev 4	2019-07-26
snort	ET TROJAN Gh0st RAT Backdoor Checkin	rev 3	2017-09-14
yara	IronTiger_Gh0stRAT_variant	—	—