New Sugar Gh0st RAT targets Uzbekistan government and South Korea
Summary: Cisco Talos found four SugarGh0st samples in a campaign likely targeting Uzbekistan and South Korea, including one sent to a Ministry of Foreign Affairs of Uzbekistan employee via a phishing email with a malicious RAR archive containing a Windows Shortcut LNK file. The RAT is a customized Gh0st RAT variant, compiled Aug. 23, 2023, that adds ODBC registry reconnaissance, library loading by specific extension and function name, modified C2 commands, and an eight-byte magic header instead of five, while retaining remote control, keylogging, webcam hooks, and arbitrary binary execution.
Key Takeaway: The decoy metadata points to Chinese-speaking actors, and the Uzbekistan Ministry of Foreign Affairs targeting aligns with the scope of Chinese intelligence activity abroad - a government inbox opened one archive and handed over a backdoor that clears the Application, Security, and System event logs to cover its tracks.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026