Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
high threatRATMalware Family
Historical
Gh0st RAT
High severity
5.3k
IOCs Tracked
—
First Seen
—
Last Seen
0
YARA Rules
Associated IOCs5,260 total · showing 50
IP50
91.202.233.2142026-10-04High
109.73.193.2422026-10-01High
15.204.95.2282026-10-04High
221.207.101.1752026-10-04High
46.151.182.2052026-10-04High
162.248.225.1652026-10-04High
5.101.86.982026-07-04High
5.101.86.1052026-07-06High
178.16.54.2482026-06-23High
88.119.167.1432026-08-17High
84.21.189.2252026-06-20High
163.181.208.792026-10-04High
137.184.163.272026-10-04High
139.159.203.442026-10-04High
8.152.2.862026-09-13High
158.247.194.1442026-08-19High
38.181.42.1602026-09-13High
154.88.97.412026-07-15High
18.118.196.2442026-07-02High
146.70.41.1742026-07-30High
Related Reports30 shown
8 API Security Tools: Our Top Picks by Use Case (2026)
Cyber PressOct 2, 2026
Attack Surface Management in 2026: Why Point-in-Time Scans Can’t Keep Up With Cloud Sprawl
CybleSep 28, 2026
New AI-Powered Botnet Hijacks Exposed Docker Servers and Steals API Keys
Cyber PressSep 28, 2026
CARBONATO Botnet Uses AI Agent to Hijack Exposed Docker Hosts and Steal Cloud Credentials
Cyber PressSep 25, 2026
CARBONATO: a botnet built around an AI agent
ThreatDownSep 23, 2026
How MSSPs Can Prove Their Value When “Nothing Happened”
ANY.RUN Cybersecurity BlogSep 17, 2026
The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament
Group-IB
US Finance Under Phishing Pressure: What the SOC Data Reveals?
ANY.RUN Cybersecurity BlogAug 26, 2026
North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs
ANY.RUN Cybersecurity BlogAug 20, 2026
How Grok unknowingly powers cybercrime
ThreatDownAug 19, 2026
OpenPhish (300 entries)
OpenPhish
Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup
ANY.RUN Cybersecurity BlogAug 10, 2026
Detecting Certighost (CVE-2026-54121): Sigma Coverage Across the Full Attack Chain
Nextron SystemsAug 4, 2026
Nearly 1 in 4 Exploited Vulnerabilities Are Attacked Before or on Disclosure Day
Cyber PressJul 30, 2026
Researchers Link Chinese Cyber Vendor to PLA’s RedRelay Covert Attack Network
Cyber PressJul 28, 2026
Russian-Speaking Hacker Jailbreaks Claude Opus to Build AI Pentesting Tool
Cyber PressJul 22, 2026
DigiCert Security Breach Linked to GoldenEyeDog Certificate Hijacking Campaign
Cyber PressJul 20, 2026
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Threat Profile
TypeRAT
StatusHistorical
IOCs tracked5,260