Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 18:10:33 UTC
Home > List all groups > List all tools > List all groups using tool GHOSTSPIDER
 Tool: GHOSTSPIDER
Names GHOSTSPIDER
Category Malware
Type Backdoor
Description
(Trend Micro) GHOSTSPIDER is a sophisticated multi-modular backdoor designed with
several layers to load different modules based on specific purposes. This backdoor
communicates with its C&C server using a custom protocol protected by Transport Layer
Security (TLS), ensuring secure communication.
Information <https://www.trendmicro.com/en_us/research/24/k/earth-estries.html>
Last change to this tool card: 28 December 2024
Download this tool card in JSON format
All groups using tool GHOSTSPIDER
Changed Name Country Observed
APT groups
  Salt Typhoon, GhostEmperor 2020-Feb 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8a9a92ff-e388-4c1c-bc8c-89569d7b5291
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8a9a92ff-e388-4c1c-bc8c-89569d7b5291
Page 1 of 1