Ghost Ransomware: Striking Before You Even Know It’s There by Lucie Cardiet

Ghost (aka Cring, Crypt3r, Phantom, Strike, Hello, Wickrme, HsHarada, Rapture) is a fast-moving ransomware operator that exploits unpatched public-facing software (e.g., Fortinet, Exchange, ColdFusion) to gain immediate access, escalate privileges (SharpZeroLogon, BadPotato), disable endpoint defenses, move laterally via PowerShell/WMI/SMB/RDP, and encrypt files—often within hours or the same day—demanding cryptocurrency ransoms rather than prioritizing long-term persistence.