GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | FamousSparrow |
| OSINT | UNC2286 |
| OSINT | Salt Typhoon |
| OSINT | RedMike |
| OSINT | OPERATOR PANDA |
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names GhostEmperor, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to GhostEmperor. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.