GhostCryptMalware
Ransomware Based on Hidden TearFrom MISP Galaxy
Last reported 2 months ago, by Recorded Future1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1055Process Injection
“Their offerings often combine payload wrapping, in-memory execution, anti-analysis checks, process injection, persistence options, delivery packaging, and post-detection “cleaning” or re-crypting services.”
- T1480Execution Guardrails
“For instance, many crypting services include execution guardrails or methods for indicator suppression, such as ensuring execution fails in virtual environments or performing environmental scanning before execution to determine whether the payload is running in an analysis or san…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Malware Crypting Services and the Threat Actors Who Sell Them“…ce, in July 2025, eSentire reported an association between PureRAT, a remote access trojan (RAT) first advertised in January 2023, and GhostCrypt, a crypting service sold by an underground forum member of the same moniker, in an attack that impacted a public US accounting firm in…”
Thanks — we review every report.