Have you been haunted by the Gh0st RAT today?
Summary: Volexity reported in March 2017 that organizations worldwide were receiving alerts claiming servers were infected with the Gh0st RAT, and that these alerts were very likely false positives caused by Shodan scanning the Internet to identify Gh0st command and control servers. The scans send a packet beginning with the string "Gh0st" and carrying a zlib-compressed payload that decodes to a fake infected Windows 7 system named WIN-T9UN4HIIHEC with IP 192.168.1.60 and a webcam present.
Bottom line: A scanner cataloging the Internet can make your monitoring appliances report a RAT infection on a server, so the direction of the traffic - inbound scanning versus outbound beaconing - is what separates a false alarm from a real compromise.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026