Gh0st RAT is a malware family tracked by ThreatCluster, appearing in 6 threat clusters built from 8 intelligence report mentions.
Gh0st RAT is a malware family tracked across 6 threat clusters and 8 intelligence report mentions on ThreatCluster. First observed October 31, 2025; most recent activity June 22, 2026.
The China-aligned APT group Webworm has shifted its focus from Asia to Europe, targeting government organizations in Belgium, Italy, Poland, Serbia, and Spain during 2025. ESET researchers identified new backdoors,…
In June 2026, a malware campaign was identified that spreads malicious VBScript files through WhatsApp direct messages. The campaign primarily targets users of WhatsApp Desktop and WhatsApp Web, with the highest number…
A new malware campaign has been identified that combines the Gh0st Remote Access Trojan (RAT) with CloverPlus adware. This dual threat allows attackers to maintain long-term control over infected systems while…
A China-linked hacking group, UNC6384, has exploited a Windows zero-day vulnerability to conduct cyber espionage against European diplomats in Hungary, Belgium, and other nations. The attacks, which occurred in…
Microsoft has mitigated a high-severity Windows LNK vulnerability, tracked as CVE-2025-9491, which has been exploited by state-backed and cybercrime groups in zero-day attacks. This flaw allows attackers to hide…
A Chinese-linked hacking group, UNC6384, has been exploiting a Windows shortcut vulnerability to conduct cyber espionage against European diplomats in Hungary, Belgium, and other nations. The attacks involve spear…
Gh0st RAT is a malware family tracked by ThreatCluster, appearing in 6 threat clusters built from 8 intelligence report mentions.
The most recent intelligence report mentioning Gh0st RAT on ThreatCluster is dated June 22, 2026. Activity was first observed October 31, 2025, giving a tracked span from then to June 22, 2026.
Across ThreatCluster reporting, Gh0st RAT most frequently co-occurs with Apt37, Apt43, Bitter, Evil Corp, Kimsuky, among 12 tracked related entities.
The most significant recent cluster is “Webworm APT Expands Operations to Europe with New Backdoors” (12 articles · Updated May 20, 2026). Gh0st RAT appears across 6 threat clusters in total, listed above with sources.
Gh0st RAT appears in 8 intelligence report mentions across 6 deduplicated threat clusters, aggregated from 17,000+ monitored sources.