Network
AS205759 CIDRs
Primary GhostyNetworks ranges. Drop at the edge.
- 64.89.160.0/24Primary US range
- 46.151.182.0/24Netherlands range
- 43.228.157.0/24Pakistan range
- 64.89.160.0/23AS205759 aggregate range
Playbook
Defend
Block the infrastructure. Patch the vulnerabilities. Hunt the components. Copy-ready lists for enforcement — verify against live feeds before production use.
Network
Full network blocklist
ASNs, CIDRs, IPs, domains, and URLs across all six campaigns.
35 indicators · includes rotating ClickFix C2 and Ghostwriter .icu hosts
Patch
CVE-2018-13379
Fortinet FortiOS — HIGH
CVE-2010-2861
Adobe ColdFusion
CVE-2009-3960
Adobe ColdFusion
CVE-2021-34473
Microsoft Exchange — HIGH
CVE-2021-34523
Microsoft Exchange — HIGH
CVE-2021-31207
Microsoft Exchange — HIGH
CVE-2026-26980
Ghost CMS 3.24.0–6.19.0 — CVSS 9.4 CRITICAL
Hunt queries
Cring payloads
Hunt for Cring.exe, Ghost.exe, Locker.exe, ElysiumO.exe, Crypt3r on disk and in process listings.
Ghostwriter OYSTER
Hunt OYSTERSHUCK / amplifier.js, OYSTERFRESH / certificate.js, OYSTERBLUES / Oyster.js, EdgeSystemConfig.dll, and Run keys MicrosoftEdgeUpdate + WindowsEdgeStartup.
GhostNet toolkit
Monitor unauthorized trust-store modifications, local loopback SSL proxies, and HVNC sessions. C2 51.89.204.28:4444.
ClickFix interstitial
Look for injected CMS posts, cloud-verification.com lookalikes, /11z77u3.php, and UtilifySetup.exe / update.zip drops.
Filename set: Cring.exe · Ghost.exe · Locker.exe · ElysiumO.exe · Crypt3r · UtilifySetup.exe · update.zip · OYSTERSHUCK · OYSTERFRESH · OYSTERBLUES · amplifier.js · certificate.js · Oyster.js · EdgeSystemConfig.dll · EdgeTaskMachine.js
Detection
YARA, Sigma, KQL, SPL, and EQL for Ghost/Cring live in the public defender toolkit. VirusTotal holds the ClickFix collection.