GhostRThreat actor
Ghostr is a financially motivated threat actor known for stealing a confidential database containing 5.3 million records from the World-Check and leaking about 186GB of data from a stock trading platform. They have been active on Breachforums[.]is, revealing massive data breaches involving comprehensive details of Thai users, including full names, phone numbers, email addresses, and ID card numbers.From MISP Galaxy
Last reported 19 months ago, by Group-IB1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1036Masquerading
“Act 4: Masquerading as 0mid16B”
What the reports say
1 report, newest first · the exact sentence from each-
The Cybercriminal with Four Faces: Revealing Group-IB’s Investigation into ALTDOS, DESORDEN, GHOSTR and 0mid16B“Additionally, he included a disclaimer: “GhostR does not sell hacking services or databases on Telegram or any other platforms.” This mirrored DESORDEN’s past attempts to prevent impersonation, further reinforcing the likelihood that GHOSTR was simply a rebranded version of DESOR…”
Thanks — we review every report.