ThreatCluster

Global JS Malware Campaign Leveraging GHOSTYNETWORKS and OMEGATECH Hosting

First seen 28 May 2026, 12:58 UTC • •67

Article Content

1 / 3

Browse articles

ThreatCluster •May 29, 2026 at 12:56 UTC

•Hackers used GHOSTYNETWORKS and OMEGATECH for a large-scale JS malware campaign.
•Malicious emails delivered a JavaScript backdoor to critical sectors like energy and finance.
•The operation's infrastructure is designed to evade detection and sustain long-term attacks.

In March 2026, hackers exploited GHOSTYNETWORKS and OMEGATECH to deploy a JavaScript backdoor via malspam targeting various sectors, including energy and finance. The operation involved sending malicious emails with ZIP or RAR attachments containing the malware. Organizations across multiple countries were affected, indicating a wide scope of impact. The infrastructure used is designed to evade detection and maintain persistence. This campaign highlights the ongoing threat posed by bulletproof hosting services in facilitating cybercrime. Current status indicates ongoing malspam activity without immediate remediation steps reported.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 140d ago How this analysis works

Timeline

2026-03-01

Malspam campaign initiated

Hackers began distributing malicious emails with JS backdoors targeting various sectors globally.

2026-03-15

Widespread impact reported

Organizations in energy, automotive, and finance sectors reported successful infections from the malspam campaign.

Cybersecuritynews

2026-05-28

Current status update

As of today, the malspam campaign continues with no reported remediation measures in place.

More articles in this cluster (2)

Threat Graph

6 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

Ghostynetworks
Omegatech

Technique (4)

Malware
Phishing
T1566.001 - Spearphishing Attachment
T1566 - Phishing

Relationships

Ghostynetworks uses Malware
Ghostynetworks uses Phishing
Ghostynetworks uses T1566.001 - Spearphishing Attachment
Ghostynetworks uses T1566 - Phishing
Omegatech uses Malware
Omegatech uses Phishing
Omegatech uses T1566.001 - Spearphishing Attachment
Omegatech uses T1566 - Phishing

Following this threat?

Track Ghostynetworks in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…