Have you been haunted by the Gh0st RAT today?

Volexity observed Shodan scanning activity that mimics Gh0st RAT C2 traffic, including a zlib-compressed payload and a decoded TOKEN string, which is causing widespread false-positive alerts on network monitoring/security appliances; the advisory explains how to identify these inbound scans (source = Shodan, payload match) and recommends tuning signatures to alert on outbound traffic to avoid misclassification.