Ghost Crypt Powers PureRAT with Hypnosis
Essential information
- Published
- 21/07/2025 08:42
- Modified
- 21/07/2025 11:28
- Tags
- 2025-07-21 ghostcrypt purerat remote access trojan
- Related entities
- 2 vulnerabilities (cve), 18 observables, 14 techniques (mitre), 1 malware
Description
In May 2025, eSentire's Threat Response Unit (TRU) uncovered a targeted attack on a U.S. accounting firm. The attackers used a newly advertised crypter service, Ghost Crypt, to sideload and obfuscate a DLL into a legitimate Windows component (csc.exe), deploying PureRAT, a Remote Access Trojan that surged in 2025