Operation_Ghoul__2016__Operation_Ghoul_targeted_attacks_on_industrial_and_engineering_organizations_-_Securelist.pdf

Operation Ghoul is a financially motivated targeted campaign documented by Kaspersky that used spear‑phishing emails (often with 7z attachments) to deliver Hawkeye-based spyware to over 130 organizations across 30+ countries, primarily in industrial, engineering and manufacturing sectors; the malware captured keystrokes, credentials, screenshots and other sensitive data and exfiltrated it to attacker-controlled servers (notably 192.169.82.86). The report provides technical details, IoCs (MD5 hashes, domains, URLs, file paths), victim geography/industry breakdown and detection signatures, and recommends heightened email/privileged-user defenses.