Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT

Executive Summary: This report details two interconnected 2025 malware campaigns that used large-scale brand impersonation and thousands of disposable domains to distribute Gh0st RAT to Chinese-speaking users. Campaign Trio (Feb–Mar) relied on mass-registered domains serving trojanized MSI/EXE installers from centralized hosting, while Campaign Chorus (May onward) evolved to multi-stage droppers, VBScript assemblers, cloud-hosted payloads and DLL side‑loading to evade defenses; the report provides TTP mapping to MITRE ATT&CK, infrastructure and IoCs (IPs, domains, file hashes), and mitigation guidance.