GhostEmperor, a Chinese-based cyber-espionage threat group, has been discovered targeting several high-profile individuals across the Southeast Asia region since mid-2020. The espionage group utilizes numerous sophisticated programs to gain access and establish persistence via a powerful rootkit, targeting front-facing servers as the point of compromise. Further exploitation allows for consistent communications to command-and-control (C2) servers, permitting remote desktop control, filesystem control, console access and PowerShell script execution. GhostEmperor’s tactics also include extensive “unusual and sophisticated anti-forensic and anti-analysis techniques” in order to evade detection by commonly used sandbox platforms and malware analysis techniques. Furthermore, GhostEmperor modifies the communications between the compromised device(s) and the command-and-control nodes, portraying the malicious data and fake multimedia formats. CTAPT will continue to monitor the movements of GhostEmperor and provide additional intelligence accordingly.