Unit 42 Uncovers Two Massive Global Malware Campaigns Delivering Gh0st RAT Through Large-Scale Software Impersonation

Researchers at Palo Alto Networks Unit 42 have uncovered two expansive, interconnected malware campaigns active throughout 2025 that mass-distributed Gh0st RAT to Chinese-speaking users, evolving from simple droppers to multi-stage infection chains using signed software, cloud infrastructure and DLL sideloading for stealth and persistence, according to Unit 42.

The campaigns—Campaign Trio and Campaign Chorus—impersonated dozens of Chinese and international software brands across more than 2,500 malicious domains, with attackers registering over 2,000 domains between February and March 2025.

Campaign Trio relied on MSI packages to load a second-stage 1.7 MB executable named [System Process]5.exe that downloaded and launched Gh0st RAT, while Campaign Chorus, beginning in May 2025, impersonated over 40 applications and introduced a VBScript dropper inside MSI and DLL sideloading via a malicious wsc.dll loaded by a legitimate Avast-signed wsc_proxy.exe.

The operation also used public cloud storage buckets as a delivery mechanism, enabling malicious ZIP archives to be fetched from cloud services, and the Gh0st RAT payload provides keystroke logging, screenshot capture, remote shell and the ability to download additional malware.