{
  "name": "SugarGh0st RAT Used to Target American Artificial Intelligence Experts",
  "slug": "sugargh0st-rat-used-to-target-american-artificial-intelligence-experts",
  "description": "This intelligence report provides details about a SugarGh0st RAT campaign conducted by an unattributed threat actor, tracked as UNK_SweetSpecter, targeting organizations in the United States involved in artificial intelligence (AI) efforts across academia, private industry, and government. The campaign employed phishing emails with AI-themed lures to deliver the customized Gh0stRAT variant. The objective was likely to obtain non-public information about generative AI, coinciding with recent reports of U.S. efforts to limit Chinese access to such technologies.",
  "published": "2024-05-16T08:07:18+00:00",
  "created_at": "2024-05-16T08:07:18+00:00",
  "modified_at": "2024-05-16T08:31:27+00:00",
  "created_at_opencti": "2024-05-16T08:07:18+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-05-11",
    "2024-05-16",
    "ai",
    "gh0strat",
    "phishing",
    "rat",
    "sugargh0st",
    "sugargh0st rat"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "43.242.203.115"
      },
      {
        "id": "",
        "name": "103.148.245.235"
      },
      {
        "id": "",
        "name": "account.gommask.online"
      },
      {
        "id": "",
        "name": "account.drive-google-com.tk"
      },
      {
        "id": "",
        "name": "feae7b2b79c533a522343ac9e1aa7f8a2cdf38691fbd333537cb15dd2ee9397e"
      },
      {
        "id": "",
        "name": "fc779f02a40948568321d7f11b5432676e2be65f037acfed344b36cc3dac16fc"
      },
      {
        "id": "",
        "name": "da749785033087ca5d47ee65aef2818d4ed81ef217bfd4bc07be2d0bf105b1bf"
      },
      {
        "id": "",
        "name": "71f5ce42714289658200739ce0bbe439f6ef6fe77a5f6757b1cf21200fc59af7"
      },
      {
        "id": "",
        "name": "4ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379"
      }
    ],
    "malware": [
      {
        "id": "4d92be5e-dab4-4242-93c4-73bb74089002",
        "name": "SugarGh0st RAT",
        "slug": "sugargh0st-rat"
      }
    ],
    "intrusion_sets": [
      {
        "id": "1ae5c139-faa7-423d-8f1f-d1c716659b6b",
        "name": "UNK_SweetSpecter",
        "slug": "unk_sweetspecter"
      }
    ],
    "attack_patterns": [
      {
        "id": "dea4e00b-6e38-4223-a0f2-8a44e403019b",
        "name": "T1564.003"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "6a495275-5433-4b64-90e5-18b9f07296da",
        "name": "T1072"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Education"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://www.proofpoint.com/us/blog/threat-insight/security-brief-artificial-sweetener-sugargh0st-rat-used-target-american",
    "https://otx.alienvault.com/pulse/6645dad6f9c2b007f2405974"
  ]
}