GhostEmperor
No sourced public emblem in this profile.
reference profile · reported nexus: CN (not nationality)
GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets.
Source-reported aliases: FamousSparrow, UNC2286, Salt Typhoon, RedMike, OPERATOR PANDA. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/
https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/
https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf
https://cloud.google.com/blog/topics/threat-intelligence/unc4841-post-barracuda-zero-day-remediation
https://www.sygnia.co/blog/ghost-emperor-demodex-rootkit/
https://www.wsj.com/politics/national-security/china-cyberattack-internet-providers-260bd835
https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices