--- title: Chinese Hackers Deploy SpiceRAT and SugarGh0st in Global... description: A new advanced persistent threat group called SneakyChef has been identified, deploying sophisticated malware including modified Gh0st RAT (SugarGh0st) and a... canonical: https://daily.dev/posts/chinese-hackers-deploy-spicerat-and-sugargh0st-in-global-espionage-campaign-aavy0fvf4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Chinese Hackers Deploy SpiceRAT and SugarGh0st in Global Espionage Campaign | daily.dev og:description: A new advanced persistent threat group called SneakyChef has been identified, deploying sophisticated malware including modified Gh0st RAT (SugarGh0st) and a... og:url: https://daily.dev/posts/chinese-hackers-deploy-spicerat-and-sugargh0st-in-global-espionage-campaign-aavy0fvf4 og:image: https://api.daily.dev/og/posts/AAvY0Fvf4.png og:image:alt: Chinese Hackers Deploy SpiceRAT and SugarGh0st in Global Espionage Campaign og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Chinese Hackers Deploy SpiceRAT and SugarGh0st in Global Espionage Campaign **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary A new advanced persistent threat group called SneakyChef has been identified, deploying sophisticated malware including modified Gh0st RAT (SugarGh0st) and a new Remote Access Trojan (SpiceRAT). The campaign targets government entities and organizations involved in AI research globally, using advanced techniques like DLL side-loading and self-extracting RAR files to evade detection. ## Content # Chinese Hackers Deploy SpiceRAT and SugarGh0st in Global Espionage Campaign A previously undocumented Chinese-speaking Advanced Persistent Threat (APT) group known as 'SneakyChef' has been identified as the force behind a sophisticated espionage campaign. This operation primarily targets government entities across Asia, the EMEA regions, and U.S. organizations, particularly those involved in artificial intelligence (AI) research. ## Target Scope and Techniques The attack methods employed by SneakyChef display an advanced level of sophistication. The group uses Windows Shortcut files and self-extracting RAR archives as part of its toolset to deliver malware effectively. By leveraging these methods, they can obscure their activities and increase the likelihood of successful infections. ## SugarGh0st RAT Central to their operational arsenal is a modified version of the Gh0st RAT, known as SugarGh0st RAT. This malware has been observed targeting various government ministries, including those in South Korea, Uzbekistan, and Angola, to name a few. The deployment strategy typically involves self-extracting RAR files, which can drop decoy documents, DLL loaders, encrypted malware, and malicious scripts onto the victim's systems. ## New Addition: SpiceRAT In a notable development, a new Remote Access Trojan (RAT) named SpiceRAT has been detected. The malware propagates through DLL side-loading—an advanced technique where a legitimate application is tricked into loading a malicious DLL file. This new RAT represents an expansion in both the scope and sophistication of SneakyChef's toolkit. ## Attribution and Impact Despite the advanced techniques and clear indicators of Chinese origins, SneakyChef has not been definitively linked to any specific government. These attacks underscore a troubling trend of increasing sophistication and broader target ranges, posing significant risks to global cybersecurity. In summary, SneakyChef's recent activities using SugarGh0st and SpiceRAT highlight an alarming leap in both technique and target diversity, urging organizations worldwide to bolster their defenses against such advanced cyber threats. --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/chinese-hackers-deploy-spicerat-and-sugargh0st-in-global-espionage-campaign-aavy0fvf4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Chinese Hackers Deploy SpiceRAT and SugarGh0st in Global Espionage Campaign","url":"https://daily.dev/posts/chinese-hackers-deploy-spicerat-and-sugargh0st-in-global-espionage-campaign-aavy0fvf4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/chinese-hackers-deploy-spicerat-and-sugargh0st-in-global-espionage-campaign-aavy0fvf4"},"datePublished":"2024-06-21T20:45:19.271Z","dateModified":"2024-06-21T20:45:32.097Z","description":"A new advanced persistent threat group called SneakyChef has been identified, deploying sophisticated malware including modified Gh0st RAT (SugarGh0st) and a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/99328603e073c472a82b7fd33afd39d8?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/99328603e073c472a82b7fd33afd39d8?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/chinese-hackers-deploy-spicerat-and-sugargh0st-in-global-espionage-campaign-aavy0fvf4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,malware","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Chinese Hackers Deploy SpiceRAT and SugarGh0st in Global Espionage Campaign"}]} ```