Sneaky Chef espionage group targets government agencies with Sugar Gh0st and more infection techniques
Summary: Cisco Talos named a threat actor "SneakyChef" and attributed past SugarGh0st RAT attacks to it, assessing with medium confidence that the operators are likely Chinese-speaking based on language preferences, use of Gh0st RAT variants, and targets including foreign ministries and government entities. In the newly observed campaign Talos found an SFX RAR initial vector that drops a decoy document, DLL loader, encrypted SugarGh0st, and a malicious VB script into the user profile temporary folder, establishing persistence via the UserInitMprLogonScript registry key.
Why it matters: Talos reports that despite its November 2023 disclosure, SneakyChef kept using the same C2 domain account[.]drive-google-com[.]tk and deployed new samples afterward, with Umbrella resolutions to that domain still observed until mid-May. Decoy documents impersonating the foreign ministries of Angola, Turkmenistan, Kazakhstan, India, and Latvia show the group building lures around real government business rather than generic bait.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026