EYES ONLY · Metatron AI · Ghost Desk
Command · 03 SEP 2026
Six active campaigns united by stealth, evasion, and resilient infrastructure — bulletproof hosting, ransomware, a CMS supply-chain attack, a Belarus-linked APT, and two GhostNet clusters.
Campaigns
6
Indicators
78
Critical
4
CVEs
7
All active
Bulletproof Hosting
U.S.-registered bulletproof hosting provider (Ghosty Networks LLC, Kentucky, January 2026) supplying resilient infrastructure for cybercrime. Linked to the defunct OPTIBOUNCE network and AnonRDP. Organizing name Daniel Mishayev appears across multiple Kentucky-registered companies tied to abusive content.
Ransomware
China-nexus ransomware operators active since early 2021 across 70+ countries. Covered by joint FBI / CISA / MS-ISAC advisory AA25-050A (#StopRansomware: Ghost (Cring) Ransomware). 2025–2026 campaigns likely deploy newer variants than public samples.
Supply Chain Attack
Critical Ghost CMS vulnerability (CVE-2026-26980, CVSS 9.4) affecting versions 3.24.0 through 6.19.0, actively exploited. 700+ domains compromised, including Harvard, Oxford, Auburn, DuckDuckGo's blog, and EuroPython Society. At least two unrelated threat actors are exploiting the same flaw.
APT / Espionage
Belarus-linked APT active since spring 2026 against Ukrainian government organizations. Uses Prometheus-themed lures and has shifted toward Gmail accounts of Polish public figures. UNC1151 / Ghostwriter is assessed as linked to Belarusian intelligence services.
Cross-Platform Malware
Commercial cross-platform malware toolkit advertised on Exploit.in, targeting Windows, macOS, and Linux from a single C2. Distinct from the historical GhostNet espionage campaign; this is a crimeware product (MedusaHVNC lineage).
RAT / Espionage
Long-running Windows RAT associated with Chinese-language threat activity and historically linked to the original GhostNet espionage campaign. Still observed in samples and reporting; treat as a separate cluster from the commercial GhostNet toolkit.
The Ghost threat landscape spans bulletproof hosting (GHOSTYNETWORKS), ransomware (Ghost/Cring), a CMS supply-chain attack (CVE-2026-26980 with 700+ compromised domains), a Belarus-linked APT (Ghostwriter/UNC1151), and a cross-platform malware toolkit (GhostNet). Block the infrastructure. Patch the vulnerabilities. Hunt the components. Report to FBI and CISA.
Execute. Adapt. Protect.
Active cyber attack
FBI · 1-800-CALL-FBICybercrime reporting
FBI IC3 · ic3.govIncident reporting
CISA · [email protected]