Ghost Ransomware Targets Orgs in 70+ Countries

The CISA advisory describes Ghost, a prolific China-backed ransomware group active since 2021 that has impacted victims in over 70 countries by exploiting unpatched Internet-facing systems (e.g., Fortinet FortiOS, Adobe ColdFusion, Microsoft SharePoint and Exchange ProxyShell). Ghost actors move rapidly from initial access to encryption—often within a single day—use Cobalt Strike for command-and-control, rotate ransomware binaries and ransom notes, claim data exfiltration to coerce payment, and typically demand tens to hundreds of thousands of dollars; the advisory provides IoCs and emphasizes patching and Cobalt Strike detection as primary mitigations.