[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIXz2vTS3dOdcryeQQx7ADBgy9GnoN6rrXu0ZeJU9Wfs":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":13,"country":14,"suspected_sponsor":15,"target_industries":16,"target_countries":17,"incident_types":18,"references":19,"techniques":28,"technique_count":29,"created_at":30,"seoMetadata":31,"schemaOrg":35},"GhostEmperor","ghostemperor",[9,10,11,12],"FamousSparrow","UNC2286","Salt Typhoon","RedMike","GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets.","CN",null,[],[],[],[20,21,22,23,24,25,26,27],"https:\u002F\u002Fsecurelist.com\u002Fghostemperor-from-proxylogon-to-kernel-mode\u002F104407\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2021\u002F09\u002F30094337\u002FGhostEmperor_technical-details_PDF_eng.pdf","https:\u002F\u002Fwww.welivesecurity.com\u002F2021\u002F09\u002F23\u002Ffamoussparrow-suspicious-hotel-guest\u002F","https:\u002F\u002Fwww.ncsc.gov.uk\u002Ffiles\u002FNCSC-MAR-SparrowDoor.pdf","https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Func4841-post-barracuda-zero-day-remediation","https:\u002F\u002Fwww.sygnia.co\u002Fblog\u002Fghost-emperor-demodex-rootkit\u002F","https:\u002F\u002Fwww.wsj.com\u002Fpolitics\u002Fnational-security\u002Fchina-cyberattack-internet-providers-260bd835","https:\u002F\u002Fwww.recordedfuture.com\u002Fresearch\u002Fredmike-salt-typhoon-exploits-vulnerable-devices",[],0,"2024-02-06T02:15:03.385813+00:00",{"title":32,"metaDescription":33,"keywords":34},"GhostEmperor Threat Actor Profile | EdgeProtect","GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel...","GhostEmperor, FamousSparrow, UNC2286, Salt Typhoon, RedMike, threat actor, APT, cyber threat, threat intelligence, CN",{"@context":36,"@type":37,"name":6,"alternateName":38,"description":13,"url":39,"mainEntityOfPage":40,"location":42},"https:\u002F\u002Fschema.org","Organization",[9,10,11,12],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fghostemperor",{"@type":41,"@id":39},"WebPage",{"@type":43,"name":14},"Country"]