Ghost Dragon
Ghost Dragon is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets organisations in China. It uses 9 MITRE ATT&CK techniques.
- Techniques
- 9
- Exploited CVEs
- No CVE data
- First seen
- Apr 22, 2016
- Last seen
- Apr 22, 2016
- Record updated
Who They Target.
Countries · 1
How They Operate · MITRE ATT&CK.
9 techniques across 8 of 14 tacticsResource Development·
Initial Access1
T1566.001
Phishing: Spearphishing Attachment
Phishing: Spearphishing Attachment
Execution1
T1574.002
Hijack Execution Flow: DLL Side-Loading
Hijack Execution Flow: DLL Side-Loading
Persistence1
T1136.001
Create Account: Local Account
Create Account: Local Account
Privilege Escalation·
Defense Evasion1
T1027
Obfuscated Files or Information
Obfuscated Files or Information
Credential Access1
T1056.001
Input Capture: Keylogging
Input Capture: Keylogging
Discovery1
T1125
Video Capture
Video Capture
Lateral Movement·
Collection1
T1123
Audio Capture
Audio Capture
Command and Control·
Exfiltration·
Impact·
Vulnerabilities Linked To Their Tools.
Browse Vulnerability Intelligence →Arsenal · Malware And Tools.
- Farflimalware
Indicators Of Compromise.
TLP:AMBER- Hash
99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2 - Hash
b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5
36 more indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Ghost Dragon.
An advanced persistent threat group targeting users primarily in China and Russia using customized variants of Gh0st RAT.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.