Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT

According to Unit 42, two interconnected malware campaigns operated through 2025, targeting Chinese-speaking users with Gh0st RAT variants. The first campaign, active from February to March 2025 and called Campaign Trio, impersonated three brands and deployed over 2,000 domains that mapped to just three IP addresses to host the malicious installers.

The second campaign, launched in May 2025 and named Campaign Chorus, expanded to impersonate over 40 applications in a two-wave operation and adopted a more intricate multi-stage infection chain, including VBScript dropper and DLL side-loading to evade detection.

The Gh0st RAT payload provided capabilities such as keystroke logging, screenshots, remote shell access and command-and-control over encrypted traffic on port 8080, with infrastructure that used cloud redirection and a centralized, disposable model to sustain operations. The analysis also notes a broader shift toward cloud-hosted delivery and signed software to prolong survivability, with ongoing activity evidenced by domain registrations into mid- to late 2025.