Article
Software Shared Across ATT&CK Groups: Reuse Study
MITRE ATT&CK v19.2 data: Mimikatz is linked to 51 of 176 groups, while 503 of 607 software entries tie to one group. See the…
Read more
Malware profile
Gh0st RAT
Also known as Mydoor, Moudoor, Gh0stRAT
gh0st RAT is a remote access tool for Windows and macOS.
In short
gh0st RAT is a remote access tool for Windows and macOS. MITRE ATT&CK says its source code is public and that multiple groups have used it. It can open a remote shell, log keystrokes, capture the screen and download more files.
- Names4names in public reportsgh0st RAT · Mydoor · Moudoor
- Techniques18ATT&CK techniques listedDiscovery · Stealth · Collection
- Linked Groups4groups that use itAndariel · APT40 threat group profile · APT41
In one minute
- What it is
- A remote access tool for Windows and macOS. MITRE says its source code is public and multiple groups have used it.
- What it does
- Opens a remote shell, logs keystrokes, captures the screen, lists processes, downloads files and can wipe event logs. Talks to its command server over an encrypted TCP channel.
- Who uses it
- Attributed by the FBI and CISA, on 19 July 2021: listed among malware used by APT40. MITRE also lists Andariel, APT41 and Kimsuky; for those three MITRE's citations are vendor reports, so treat them as MITRE's view only.
- How it gets in
- No source reviewed states how it arrives. The FBI and CISA list APT40's general entry routes but do not tie them to this tool.
- What to do first
- Follow the FBI and CISA mitigations in advisory AA21-200A: log DNS queries, monitor server disk use and set network baselines to spot unusual traffic.
What it does
Because the source code is public, MITRE says many groups have used it, and variants exist. The US, UK, Canadian, Australian and New Zealand agencies wrote in 2018 that variations of Gh0st RAT had been seen against victims worldwide.
The FBI, with CISA, listed Gh0stRAT in July 2021 among the malware used by the APT40 group named in a US indictment. That advisory covers the whole group, not this tool alone.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| gh0st RAT | MITRE ATT&CK software S0032[1] |
| Mydoor | MITRE ATT&CK Associated Software[1] |
| Moudoor | MITRE ATT&CK Associated Software[1] |
| Gh0stRAT | Written "Gh0stRAT [ S0032 ]" in the FBI and CISA advisory AA21-200A[2] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Discovery
Query Registry T1012
It has checked whether a Service key exists to learn if it is already installed.[1]
Process Discovery T1057
It can list the processes running on the system.[1]
System Information Discovery T1082
It has gathered system architecture, processor, operating system settings and installed hardware details.[1]
Stealth
Process Injection T1055
It can inject code into a process created by its "Command_Create&Inject" function.[1]
Indicator Removal: File Deletion T1070.004
It can delete files.[1]
System Binary Proxy Execution: Rundll32 T1218.011
A variant has used rundll32 to run.[1]
Hijack Execution Flow: DLL T1574.001
A variant has used DLL side-loading.[1]
Collection
Command and Control
Non-Application Layer Protocol T1095
It has sent an encrypted protocol inside TCP segments to reach its command server.[1]
Ingress Tool Transfer T1105
It can download files to the victim machine.[1]
Data Encoding: Standard Encoding T1132.001
It has compressed command traffic with Zlib before encrypting it.[1]
Dynamic Resolution: Fast Flux DNS T1568.001
Its operators have used dynamic DNS to hide the real location of their command server behind changing IP addresses.[1]
Encrypted Channel: Symmetric Cryptography T1573.001
It uses RC4 and XOR to encrypt command traffic.[1]
Persistence
How it spreads
No source reviewed says how gh0st RAT is delivered. MITRE says only that its source code is public and that multiple groups have used it. The FBI and CISA advisory AA21-200A lists several general ways APT40 gains initial access, such as spearphishing and exploiting public-facing applications, but it does not say which of them delivered Gh0stRAT.
Timeline
- January 2010 to February 2016
- 11 October 2018
Five-nation report on public tools
Cyber agencies of Australia, Canada, New Zealand, the UK and the US wrote that variations of Gh0st RAT had been seen against victims worldwide.[5]
- 19 July 2021
APT40 indictment and advisory AA21-200A
The US Department of Justice unsealed an indictment against four APT40 actors. The FBI and CISA advisory lists Gh0stRAT among APT40 malware.[2]
Who uses it
- Threat group Andariel Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. North Korea · Since 2009
- Threat group APT40 threat group profile APT40 (tracked by MITRE as Leviathan) is attributed by the US and UK governments (2021) and by agencies in eight countries (2024) to China's Ministry of State Security. China · Since 2009
- Threat group APT41 MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations. China · Since 2012
- Threat group Kimsuky Attributed by the US and South Korean governments to North Korea's Reconnaissance General Bureau, Kimsuky sends convincing fake emails to think tanks, researchers, media and government staff to steal documents and email. North Korea · Since 2012
Detection and defense
Log DNS and watch for odd domains
The FBI and CISA advise logging DNS queries, considering blocking outbound DNS that does not come from approved servers, and watching for command traffic over DNS. MITRE records gh0st RAT operators hiding command servers behind changing IP addresses. The link between the two is ours.[1, 2]
Counters: T1568.001
Questions
What is gh0st RAT?
MITRE ATT&CK describes it as a remote access tool whose source code is public and which multiple groups have used.
Which groups use it?
The FBI and CISA listed Gh0stRAT in July 2021 among malware used by APT40. MITRE also lists Andariel, APT41 and Kimsuky, citing vendor reports for those three.
What can it do?
MITRE lists abilities such as opening a remote shell, logging keystrokes, capturing the screen, downloading files and wiping event logs.
What other names does it have?
MITRE lists Mydoor and Moudoor. The FBI and CISA advisory writes it as Gh0stRAT.
How do defenders reduce the risk?
The FBI and CISA advise logging DNS queries, monitoring server disk use, setting baselines and using reputation services. Their advisory covers APT40, not this tool alone.
In our research
- Software Shared Across ATT&CK Groups: Reuse Study October 2026
- Andariel Threat group
- APT18 Threat group
- APT40 threat group profile Threat group
- BlackTech threat group profile Threat group
- Remote access trojan (RAT) Glossary term
Sources
- gh0st RAT, Software S0032 MITRE ATT&CKSupports: Description, aliases, platforms, techniques, groups and campaign.
- Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China's MSS Hainan State Security Department, AA21-200A FBI and CISASupports: 19 July 2021 advisory listing Gh0stRAT among APT40 malware, with mitigations.
- Leviathan (APT40), Group G0065 MITRE ATT&CKSupports: MITRE lists gh0st RAT for Leviathan.
- Andariel, Group G0138 MITRE ATT&CKSupports: MITRE lists gh0st RAT for Andariel.
- Publicly Available Tools Seen in Cyber Incidents Worldwide, AA18-284A Cyber agencies of Australia, Canada, New Zealand, the UK and the US, published by CISASupports: 11 October 2018 report noting variations of Gh0st RAT seen against victims worldwide.
- APT41, Group G0096 MITRE ATT&CKSupports: MITRE lists gh0st RAT for APT41.
- Kimsuky, Group G0094 MITRE ATT&CKSupports: MITRE lists gh0st RAT for Kimsuky.
- Operation Dust Storm, Campaign C0016 MITRE ATT&CKSupports: Campaign dates January 2010 to February 2016 and gh0st RAT use.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.