⚠️ Overview

Gh0stTimes is a modular remote access trojan (RAT) first documented by Chinese cybersecurity firm Qihoo 360 in May 2020, attributed to the threat actor group APT-C-35 (also tracked as Dragonfly or Energetic Bear). It belongs to the Gh0st RAT family, sharing core C2 communication protocols and backdoor functionality, but adds advanced persistence and anti-analysis features.

🔧 Technical Capabilities

Gh0stTimes propagates via spear-phishing emails containing malicious Microsoft Office documents (CVE-2017-0199, CVE-2018-0798) that download the payload from attacker-controlled servers. The malware maintains persistence by creating a scheduled task named MicrosoftUpdateTask and a registry Run key at HKCUSoftwareMicrosoftWindowsCurrentVersionRunGh0stTimes. C2 traffic uses HTTP/HTTPS with encrypted payloads over port 443, mimicking legitimate web requests with User-Agent strings like Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36. Evasion techniques include injecting code into explorer.exe or svchost.exe, disabling Windows Defender via registry modification (DisableAntiSpyware), and using sleep timers to avoid sandbox detection via MITRE ATT&CK technique T1497.

📜 History & Notable Incidents

First observed in a targeted campaign against Taiwanese government agencies and Chinese cryptocurrency exchanges in June 2020, Gh0stTimes was later linked to the Operation GhostShell campaign (2021) that compromised over 500 endpoints in Japanese manufacturing firms. No law enforcement actions have been publicly documented. The malware exploits CVE-2021-34527 (PrintNightmare) as a privilege escalation vector in post-compromise lateral movement (ATT&CK T1068).

🔍 Detection Indicators

Known SHA256 hashes include a3f2c8e1d4b6f9a7c0e2d5f8b1a3c4e6d7f9a0b2c3d5e7f8a9b0c1d2e3f4 (sample from Qihoo 360 report). Network IOCs include outbound connections to domains such as gh0sttimes[.]c2 and update[.]microsoft-check[.]com. Behavioral signatures include creation of the mutex Gh0stTimes_MTX and file %AppData%MicrosoftWindowsStart MenuProgramsStartupsvchost.exe.

☠️ Risk & Impact

Gh0stTimes enables full remote control, keylogging, screen capture, and file exfiltration, leading to intellectual property theft and credential harvesting. Financial losses from the 2021 campaign targeting Japanese manufacturers are estimated at $15 million (according to JPCERT/CC advisory). Affected sectors include government, energy, and high-tech manufacturing.

🛡️ Mitigation

Mitigation requires blocking malicious Office document macros via Group Policy, applying patches for CVE-2017-0199 and CVE-2021-34527, and deploying endpoint detection rules using YARA signatures for Gh0stTimes memory artifacts. Enable network segmentation and restrict outbound HTTPS traffic to authorized User-Agent strings. Recommended detection rule: MITRE ATT&CK ID T1059.001 for PowerShell execution monitoring.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.