MalwarePublished 15 Nov 2025Updated 15 Dec 2025

Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT

Source AlienVault OTX General

Description

This report details two interconnected malware campaigns targeting Chinese-speaking users in 2025, using large-scale brand impersonation to deliver Gh0st RAT variants. The first campaign, active from February to March, mimicked three brands across over 2,000 domains. The second campaign, starting in May, impersonated over 40 applications with more sophisticated infection chains. Both campaigns used cloud infrastructure for payload delivery and DLL side-loading for evasion. The adversary demonstrated an evolving operational playbook, advancing from simple droppers to complex multi-stage infections. The campaigns' infrastructure remained active for months, indicating a persistent and well-resourced threat actor focused on Chinese-speaking targets globally.

Impact

For European organizations, the primary impact lies in potential espionage, data theft, and persistent unauthorized access if targeted by these campaigns. Organizations with Chinese-speaking employees, business partners, or customers are at increased risk due to the targeted nature of the malware. The use of brand impersonation and cloud infrastructure could lead to successful phishing or supply chain attacks, potentially compromising sensitive corporate data or intellectual property. DLL side-loading techniques may allow attackers to bypass endpoint security solutions, increasing the likelihood of stealthy infections. Persistent access via Gh0st RAT could enable attackers to conduct long-term surveillance, exfiltrate data, or deploy additional malware payloads. While the campaigns currently focus on Chinese-speaking targets, collateral infections or misdirected attacks could affect European entities, especially those with multinational operations or cloud dependencies. The operational persistence and sophistication suggest that detection and remediation may be challenging, increasing potential downtime and incident response costs.

Defensive guidance

European organizations should implement targeted detection capabilities for brand impersonation domains and monitor DNS traffic for suspicious domain generation algorithm (DGA) activity. Deploy advanced endpoint detection and response (EDR) solutions capable of identifying DLL side-loading and anomalous process behaviors. Restrict execution privileges to prevent unauthorized DLL loading by legitimate applications and enforce application whitelisting where feasible. Conduct user awareness training focused on recognizing phishing attempts that leverage brand impersonation, especially in Chinese language contexts. Monitor cloud infrastructure usage and network traffic for unusual patterns indicative of payload delivery or command and control communications. Employ threat intelligence feeds to stay updated on emerging indicators of compromise related to Gh0st RAT and associated campaigns. Regularly audit and update security controls to detect multi-stage infection chains and lateral movement. Collaborate with cybersecurity communities to share intelligence on these campaigns and coordinate defensive measures. Finally, ensure incident response plans include scenarios involving advanced persistent threats using sophisticated evasion techniques.

Indicators of compromise

Domains 89

deep-seek.bar
deep-seek.bond
deep-seek.cfd
deep-seek.qpon
deep-seek.rest
i4toolsearch.vip
i4toolssddsl.top
i4toolssddzp.top
i4toolssddzq.top
i4toolssddzr.top

IP addresses 4

103.181.134.138
154.82.84.227
156.251.25.112
156.251.25.43

Hashes 38

6e1c52be3b1b38d57430bbcaee7d367a
7cb5cea873665a41b21e216d01c23087
db591d11abfa31047843e84a004fdb8b
ddc764d0b18c5af9f7e94e9d5eebb48f
6726588885e853e40a768aad2f366e3c95e3fcad
7329711c865faf018bd1d0446613cfc1020a05b9
a06d80258da2a37c316b56cd73423a1127ff0079
d562a64b760462dbd5201d1954dd2b4e1c1268db
0076f6ea4346af5ae43db08205664092029e06bb353e3406ee649e98723182eb
1395627eca4ca8229c3e7da0a48a36d130ce6b016bb6da750b3d992888b20ab8

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 17 Nov 2025, 09:47 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Domains 89

IP addresses 4

Hashes 38

Community reviews

Related threats