Tracking GhostNet: Investigating a Cyber Espionage Network

GhostNet is a large-scale, malware-based cyber-espionage network uncovered by the Information Warfare Monitor that infected at least 1,295 hosts in 103 countries (including embassies, ministries, international organizations and Tibetan institutions). The attackers used socially engineered emails and drive-by exploits to install Trojans (notably gh0st RAT), operated web-based command-and-control interfaces and command servers (many resolving to IP space in China/Hainan), and exfiltrated sensitive documents and system data, demonstrating real-time remote control capabilities and widespread strategic targeting.