Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT

Summary: Unit 42 Palo Alto Networks identified two linked campaigns active in 2025 that used large-scale brand impersonation to deliver Gh0st RAT variants to Chinese-speaking users, beginning with Campaign Trio from February to March 2025, which mimicked three brands across more than 2,000 domains hosted on just three IP addresses. The follow-on Campaign Chorus, launched in May 2025, impersonated over 40 applications and moved to a multi-stage chain that split payloads across an MSI's .cab archive, reassembled and decrypted them via VBScript, and used DLL side-loading of wsc_proxy.exe and wsc.dll to run under a signed process.

What you should know: More than 2,000 domains resolving to three IP addresses, then a second campaign impersonating over 40 applications within months, shows an adversary treating infrastructure as disposable and iterating faster than blocklists can keep up. The final payload is Gh0st RAT, a tool Unit 42 ties to Chinese-nexus cybercrime and espionage actors who have used it for over a decade, and it grants the attacker comprehensive control of a compromised system.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related