File · GhostEmperor · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 14 techniques across 10 tactics
Last 30 days
last seen 23 d agoWhat changed
ledger · newest first- —todaynew CVE3 new CVEs: CVE-2018-0171, CVE-2023-46805, CVE-2024-3400
- —29 d agoresurfacedback on the wire — nothing in the previous 30 days
Analyst brief
misp-galaxy + mitre-attackGhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets.
Kill chain
MITRE ATT&CK Enterprise · tap a technique14 techniques · 10 of 15 tactics
Reconnaissance
1 techniqueResource development
2 techniquesInitial access
1 techniquePersistence
2 techniquesDefense impairment
2 techniquesCredential access
2 techniquesLateral movement
1 techniqueCollection
1 techniqueCommand and control
1 techniqueExfiltration
1 technique
select a technique
Arsenal
1 malware| Malware · 1 | ATT&CK |
|---|---|
| JumbledPath | S1206 ↗ |
as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
CVEs GhostEmperor is cited as exploiting
2 on CISA KEV- CVE-2024-3400KEV2026-10-17
“Salt Typhoon has leveraged vulnerabilities in public facing applications and network edge devices including Cisco IOS and IOS XE through CVE-2018-0171, Ivanti Connect Secure through CVE-2023-46805, and Palo Alto Networks GlobalProtect through CVE-2024-3400.”
cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
- CVE-2023-46805KEV2026-10-17
“Salt Typhoon has leveraged vulnerabilities in public facing applications and network edge devices including Cisco IOS and IOS XE through CVE-2018-0171, Ivanti Connect Secure through CVE-2023-46805”
cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
- CVE-2018-01712026-10-17
“Salt Typhoon has leveraged vulnerabilities in public facing applications and network edge devices including Cisco IOS and IOS XE through CVE-2018-0171”
cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
“There was only one case in which we found evidence suggesting that a Cisco vulnerability (CVE-2018-0171) was likely abused.”
cited as exploiting · named nearby · source: blog.talosintelligence.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
11 sources- 1.securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407
- 2.media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmpe…
- 3.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest
- 4.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf
- 5.cloud.google.com/blog/topics/threat-intelligence/unc4841-post-barracuda…
- 6.sygnia.co/blog/ghost-emperor-demodex-rootkit
- 7.wsj.com/politics/national-security/china-cyberattack-internet-…
- 8.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devi…
- 9.attack.mitre.org/groups/G1045
- 10.blog.talosintelligence.com/salt-typhoon-analysis
- +1 more in the JSON record
Track GhostEmperor on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.