'SneakyChef' APT Slices Up Foreign Affairs With SugarGh0st

Cisco Talos uncovered a Chinese-language APT operator called "SneakyChef" running espionage campaigns since late August using modified Gh0st RAT (SugarGh0st) and a newer implant (SpiceRAT) to target foreign ministries, agricultural ministries, and an embassy across multiple countries. The actor has moved from LNK-wrapped RARs to self-extracting RAR lures that drop decoy government documents, a DLL loader, encrypted malware, and VB persistence scripts—decoys appear legitimate and may have been obtained via prior espionage.