GhostRedirector

Linked to China by two sources.

Reports: 2
Last reported: 1 December 2025
Known CVEs: 9
Origin: China

ID: ghostredirector
Sources: MISP Malpedia
Merge evidence: 1 alias match

Reports per quarter

2025 Q3: 1 report
2025 Q4: 1 report

Dated reports, 2025 Q3 to 2025 Q4.

Techniques seen in the last two years

T1008 1 report
T1027 1 report
T1027.009 1 report
T1059.001 1 report
T1059.003 1 report
T1071.001 1 report
T1083 1 report
T1105 1 report
T1106 1 report
T1112 1 report

Show all 25 techniques Show fewer

T1134 1 report
T1140 1 report
T1190 1 report
T1219 1 report
T1546 1 report
T1559 1 report
T1565 1 report
T1583.001 1 report
T1583.004 1 report
T1587.001 1 report
T1588.002 1 report
T1588.003 1 report
T1608.001 1 report
T1608.002 1 report
T1608.006 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

CVE-2018-0171 KEV
CVE-2025-29824 KEV ransomware
CVE-2025-32433 KEV
CVE-2025-49704 KEV ransomware
CVE-2025-49706 KEV ransomware
CVE-2025-53770 KEV ransomware
CVE-2025-53771
CVE-2025-6218 KEV
CVE-2025-8088 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1 December 2025

APT and financial attacks on industrial organizations in Q3 2025 | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT and financial attacks on industrial organizations in Q3 2025 | Kaspersky ICS CERT EN
4 September 2025

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes

Newest first. Details opens the report in Explore.