Notorious Chinese Hacker Gang GhostEmperor Re-Emerges After 2 Years

Sygnia reported the return of GhostEmperor, a sophisticated Chinese-linked threat actor, using an updated Demodex kernel rootkit and improved evasion and infection techniques (including a reflective loader, obfuscation, and WMI-based command execution) to compromise networks and pivot to additional victims; the activity represents the group's first confirmed operations since 2021 and continues its targeting of telecommunications, government, and other high-value entities across multiple regions.