Ghost in the Network: GhostNet and the First State-Sponsored APT

In the spring of 2008, staff at the office of the Tibetan government-in-exile in Dharamsala, India — the administrative and spiritual home of the Dalai Lama — began noticing that sensitive emails were being intercepted.

Delegations would arrive at diplomatic meetings with counterparts who seemed already to know what the Tibetan leadership had said in private correspondence. Travel itineraries for the Dalai Lama would be circulated to governments before formal requests had been submitted, and those governments would abruptly decline to issue visas. Documents shared only within the inner circle of exile officials would surface in unexpected places.

The Tibetan staff suspected their networks were compromised. They had no way to prove it, and limited technical resources to investigate. In the summer of 2008, they reached out to the Information Warfare Monitor — a joint research project of the Citizen Lab at the University of Toronto’s Munk School of Global Affairs (led by professor Ron Deibert) and the SecDev Group, a Canadian security consultancy.

Researchers Nart Villeneuve and Rafal Rohozinski traveled to Dharamsala with laptops and analysis tools. What they found when they sat down with the Tibetan networks was not what they expected.

It was not a modest intrusion by an opportunistic attacker. It was a sophisticated, long-running intelligence operation touching 1,295 computers across 103 countries — an interconnected web of compromised embassy computers, government workstations, foreign ministry servers, and civil society organizations, all feeding information back to command-and-control servers in China.

They called it GhostNet.

Threat Actor Profile: Unit 61398 / PLA (Attributed)

Designation: GhostNet (Information Warfare Monitor/Citizen Lab research designation); attributed to Unit 61398 of the People’s Liberation Army (2nd Bureau, 3rd Department of PLA General Staff Department); also linked to actors operating from Hainan province, China
Attribution: Citizen Lab (2009) attributed GhostNet to “Chinese interests” while carefully avoiding formal state attribution. The primary C2 server identified in the investigation was located in Hainan, China — an island that also hosts the PLA’s Lingshui signals intelligence facility. The US government and subsequent independent research have attributed GhostNet-related infrastructure and techniques to Chinese state-sponsored actors. China has denied all involvement.
Origin: Hainan Province, China (primary C2 infrastructure); Beijing (secondary infrastructure)
Active: At least 2007–2009 (GhostNet proper); related operations continued well beyond (Shadow Network, ongoing GhostRAT campaigns)
Primary Mission: Signals intelligence collection targeting Tibetan government-in-exile, foreign diplomatic missions, governments with Tibet/China policy relevance, civil society organizations, and foreign embassies across Asia, Africa, and the Americas
Known Tradecraft: Spear phishing targeting specific individuals, drive-by download infrastructure, GhostRAT deployment (also known as Gh0st RAT), full remote access including webcam and microphone activation, document exfiltration, long-term persistent access, command-and-control via customized protocols

Notorious Operations:

• GhostNet (2007–2009): The core operation documented by Citizen Lab. 1,295 computers in 103 countries compromised, including the foreign ministries of multiple nations, embassies of Iran, Bangladesh, Latvia, Indonesia, Philippines, Brunei, Barbados, and Bhutan, and the computer networks of the Dalai Lama’s offices in India, the UK, the US, and Belgium.
• Shadow Network (2010): A follow-up Citizen Lab investigation that found a separate but overlapping espionage network targeting the Indian military establishment. Exfiltrated documents included classified Indian government assessments of security situations in India’s northeast, a confidential Indian intelligence report on Maoist movements, and documents related to Indian diplomatic operations in Africa and Russia.
• GhostRAT Campaigns (Ongoing): The GhostRAT tool (Gh0st RAT), originally developed and used by Chinese state actors, was eventually leaked or copied and became widely used by other threat actors. The original state-sponsored campaigns continued well into the 2010s, with updated versions of the tool and infrastructure.

The Investigation: Following the Ghost

When Nart Villeneuve and his colleagues sat down with computers at the Tibetan government-in-exile offices in Dharamsala in late 2008, their first step was baseline — what was on the network, what connections were being made, what software was running.

They found infections on multiple machines. The infected machines were making outbound connections to servers in China — connections that, on their face, looked like routine internet traffic but, on closer inspection, were anything but. The connections followed a regular cadence, checking in with remote servers at predictable intervals, and the data being transmitted was encrypted in ways that suggested designed obfuscation rather than routine application behavior.

Villeneuve, who specialized in tracking online censorship and surveillance targeting political dissidents, recognized the pattern. He had seen similar technical signatures in other contexts. He began pulling threads.

The first thread led to the malware on the Tibetan machines: Gh0st RAT — short for Ghost Remote Access Trojan, a Chinese-developed tool that had been circulating in various forms in the Chinese hacking community since at least 2001. The version deployed in the Tibetan networks was more sophisticated than the older public versions — modified, updated, and configured with custom command-and-control parameters that pointed to specific servers.

The second thread led to those servers. Villeneuve didn’t just note their existence. He mapped them — identifying four primary C2 servers that were controlling the Tibetan network infections. Three were hosted on commercial internet infrastructure in different locations. The fourth — the primary server, the one that appeared to be the master controller for the entire network — was hosted by a commercial hosting provider in Hainan, China.

Hainan. The island that was also home to the PLA’s Lingshui listening station. The same island where, in 2001, a US Navy EP-3 reconnaissance aircraft had been forced to land after a collision with a Chinese fighter jet, leading to an eleven-day diplomatic standoff and the capture of US signals intelligence equipment.

The third thread was the most alarming. The C2 servers weren’t just controlling the Tibetan machines. By probing the servers’ own interfaces — using techniques that exposed the administrative structure of the botnet — Villeneuve found he could enumerate the full list of compromised machines reporting to these controllers.

There were 1,295 of them. In 103 countries.

The Gh0st RAT: Technical Architecture

Gh0st RAT (the executable was often named with the string “Gh0st” in its code, a deliberate self-identification by its authors) was, by 2008, a mature and capable piece of remote access software.

Its design followed the standard RAT architecture: a small agent installed on the target machine communicated with a controller — a server-side application running in the attackers’ infrastructure that provided a graphical interface through which operators could manage their fleet of compromised hosts.

But Gh0st RAT had capabilities that distinguished it from garden-variety commercial RATs of the era:

Full desktop control: The operator could see a real-time view of the infected machine’s screen, with mouse and keyboard control. For intelligence purposes, this meant reading documents as they were being written, watching communications as they were being composed, and observing authentication procedures that could be replicated.

File system access: Complete remote file browsing, upload, and download. The operator could browse the entire contents of the infected machine’s hard drive and exfiltrate anything of interest — documents, email archives, address books, calendar data, saved passwords.

Keylogging: Every keystroke captured, including passwords, draft documents, and search queries that never appeared in the browser’s history.

Audio and webcam access: Gh0st RAT could activate the infected machine’s microphone and, if a webcam was present, its camera. This turned any compromised laptop into a surveillance device that could observe and record conversations in the physical space where the machine was located. For the Dalai Lama’s senior staff, who discussed sensitive policy, travel, and diplomatic matters in rooms where their computers sat, this was potentially catastrophic.

Process management: The operator could view, start, and kill processes running on the infected machine — including security software.

The C2 communications protocol used by Gh0st RAT employed a simple compression and encryption scheme — not particularly sophisticated by modern standards, but sufficient to disguise the traffic from casual inspection. The protocol used a distinctive 5-byte header containing the string “Gh0st” that served as a handshake identifier — a detail that ultimately became a key detection signature, but one that went unnoticed on the Tibetan networks for at least a year.

The Delivery: Spear Phishing the Diaspora

The infection mechanism was elegant in its simplicity and devastating in its targeting precision.

The Tibetan government-in-exile operated through a network of offices in India, the United Kingdom, the United States, Belgium, and elsewhere. Staff members communicated constantly via email, sharing documents, coordinates, correspondence with foreign diplomats, and sensitive planning materials. The community was close-knit and trusted — officials regularly exchanged documents with people they knew personally.

The attackers exploited this trust.

Spear phishing emails were sent to specific individuals within the Tibetan network — not mass emails but carefully crafted messages targeted at named individuals in senior positions. The emails appeared to come from known contacts — other Tibetan officials, sympathetic foreign diplomats, journalists covering Tibet. They contained attached documents: PDF files, Word documents, CHM (compiled HTML help) files that were relevant to the recipient’s work. An attached document purporting to contain a draft of a diplomatic communiqué, or notes from a recent meeting, or press materials about an upcoming event.

When opened, these documents executed exploit code targeting vulnerabilities in widely used document viewers and office software:

PDF exploits targeting Adobe Acrobat Reader (multiple CVEs spanning 2007–2008) that executed shellcode embedded in maliciously crafted PDF files. The exploits were reliable, well-understood, and widely deployed because Acrobat Reader was universally installed and updates were often delayed.

Word document exploits targeting vulnerabilities in Microsoft Office’s handling of certain embedded objects and metadata — similar in character to the techniques Carbanak would refine years later.

CHM exploits targeting Windows’ compiled HTML help infrastructure, which had a long history of vulnerabilities and was trusted by many enterprise environments.

In each case, the execution of exploit code followed a now-familiar sequence: shellcode running in the context of the opened document would download the Gh0st RAT agent from an attacker-controlled server and install it with persistence. The document itself would display normally — or display an error message designed to seem innocuous. The user would close the document and move on.

The RAT would begin making its regular check-ins to the Hainan control server.

The Scope: 1,295 Machines in 103 Countries

What Villeneuve and his colleagues found when they mapped the GhostNet infrastructure was extraordinary not merely for its scale but for the quality of its targets.

This was not a criminal botnet accumulating zombie machines for spam campaigns. The machines reporting to GhostNet’s C2 infrastructure were carefully selected high-value targets representing a specific and coherent intelligence collection mission.

Diplomatic infrastructure: The foreign ministries of multiple countries — including Iran, Bangladesh, Latvia, Indonesia, the Philippines, Brunei, Barbados, and Bhutan — were listed in the compromised machine inventory. Workstations inside embassies in India, Pakistan, Germany, and Taiwan appeared. The Embassy of India in multiple capital cities featured prominently.

NATO-adjacent systems: At least one computer associated with NATO’s communications infrastructure appeared in the Citizen Lab analysis, though the full nature of its compromise was carefully characterized given the sensitivity.

Financial and media organizations: Several foreign banks and media organizations with significant reporting footprints in China-adjacent regions appeared in the list.

Civil society: Beyond the Tibetan network that had triggered the investigation, multiple civil society organizations monitoring Chinese human rights conditions, Tibet, and related political topics were represented.

The geographic distribution — 103 countries — spoke to the breadth of the operation. This was not a targeted campaign against a handful of adversaries. It was a comprehensive intelligence collection operation against anyone and anything that might generate information relevant to Chinese foreign policy, security policy, or the management of politically sensitive issues.

The Dalai Lama’s Office: Epicenter of the Operation

The investigation traced the deepest concentration of GhostNet infections back to where it had begun: the Office of His Holiness the Dalai Lama.

The Dalai Lama’s personal office in Dharamsala, and the associated offices in New York, London, Brussels, and elsewhere, were among the most thoroughly compromised targets in the entire network. Multiple machines at each location were infected. The machines included those used for personal correspondence, for diplomatic communications, for travel scheduling, and for coordinating with foreign governments on the Dalai Lama’s public engagements.

The significance of this cannot be overstated. The Dalai Lama’s correspondence regularly included communications with foreign heads of state, senior government officials, and political figures who treated their exchanges with his office as private and confidential. For Chinese intelligence, access to this correspondence would have provided extraordinary insight into:

• Which governments were actively engaging with the Tibetan leadership
• The content of private diplomatic communications being conducted through Tibetan channels
• Travel schedules allowing Chinese officials to anticipate the Dalai Lama’s movements and pressure host governments to deny visas in advance
• The internal thinking of Tibetan leadership about negotiating positions, political strategy, and institutional priorities

The suspicious behavior that had initially prompted the Tibetan staff to seek help — the intercepted emails, the governments that seemed to have advance knowledge of correspondence, the mysteriously declined visa applications — was entirely consistent with what GhostNet would have provided to its operators.

The surveillance had apparently been active for at minimum a year before the Citizen Lab investigation.

The Attribution Debate

The Citizen Lab report, published on March 28, 2009, was careful about attribution.

The primary investigative finding — that 1,295 computers in 103 countries were compromised and reporting to servers in China — was stated plainly, with extensive technical documentation. The physical location of the primary C2 server in Hainan was documented. The correlation between the targets of the espionage and the strategic interests of the Chinese government was articulated clearly.

But the report stopped short of definitively attributing the operation to the Chinese government or its intelligence services. The researchers noted that while the circumstantial evidence “pointed to China,” it remained “inconclusive as to the identity of the operators.” The tools used (Gh0st RAT) were publicly available in Chinese hacking communities and could theoretically have been deployed by non-state actors.

The Chinese government, through its foreign ministry, denied any involvement. A spokesperson characterized the report as “irresponsible.”

The restraint in the Citizen Lab attribution was deliberate and, in retrospect, significant. The researchers were breaking new ground. They were academics, not intelligence agencies. They had found something that, if attributed carelessly, could generate diplomatic consequences they were not equipped to manage. They chose precision over boldness.

Subsequent research — including Mandiant’s landmark APT1 report in 2013, which attributed a specific set of Chinese cyber operations to a specific PLA unit (61398) with unprecedented technical specificity — validated the Citizen Lab’s approach while also demonstrating that more direct attribution was ultimately possible and appropriate.

The Significance: The Dawn of APT Research

When the GhostNet report was published in March 2009, it landed in a security community that did not yet have a widely shared framework for thinking about what it described.

The concept of an Advanced Persistent Threat — a sophisticated, long-duration, resource-rich adversary targeting specific victims for specific intelligence purposes — existed in classified US government discussions, but had not been publicly articulated as a distinct threat category. Security professionals and executives tended to think about cyber threats in terms of opportunistic criminals and malware infections, not state-level intelligence operations operating over years against specifically chosen targets.

GhostNet changed that. The Citizen Lab’s report was the first comprehensive public documentation of what a state-sponsored APT operation actually looked like: the patient investment of time, the specific target selection tied to coherent intelligence objectives, the deployment of multiple infection vectors against a defined population, the long-term persistence, the sophisticated exfiltration of high-value documents.

The report introduced the broader public to concepts that security professionals now take for granted: the idea that a nation-state might systematically penetrate civil society organizations to monitor political dissidents; that foreign embassies might have their computers read by hostile intelligence services without ever knowing it; that a laptop sitting in a peaceful monastery in northern India might be streaming audio of private conversations to a server in China.

It predated the Mandiant APT1 report by four years. It predated the Snowden revelations by four years. It predated most of the public discourse about state-sponsored hacking by half a decade.

The researchers who went to Dharamsala looking for evidence that someone was reading the Dalai Lama’s email had found something much larger than they expected: the first documented map of the invisible war that states were already fighting in cyberspace, against targets who had no idea they were combatants.

---

Attack Chain: GhostNet — Chinese Espionage Operation (2007–2009)

graph TD
    A["🇨🇳 State Sponsor\nPLA Unit 61398 / Hainan Intelligence\nC2 Infrastructure: Hainan Province, China"] --> B["Mission: Intelligence Collection\nTargets: Tibetan Government-in-Exile\nForeign Embassies / Diplomatic Infrastructure\nCivil Society Monitoring Tibet + China"]

    B --> C["Target Mapping\nIdentify Key Personnel\nDalai Lama's Office Staff\nTibetan Diplomatic Officials\nForeign Embassy Employees"]

    C --> D["Spear Phishing Delivery\nEmails to Named Individuals\nSender: Trusted Contact (Spoofed)\nSubject: Relevant Diplomatic / Political Topic"]

    D --> E1["Malicious PDF Attachment\nAdobe Acrobat Reader Exploit\n2007–2008 CVEs\nSilent Shellcode Execution"]
    D --> E2["Malicious Word Document\nMicrosoft Office Vulnerability\nEmbedded Object Exploit\nProcess Injection on Open"]
    D --> E3["CHM (Help File) Attachment\nWindows Compiled HTML Exploit\nTrusted by Enterprise Environments\nDirect Code Execution"]

    E1 --> F["Shellcode Downloads\nGh0st RAT Agent\nFrom Attacker-Controlled Staging Server"]
    E2 --> F
    E3 --> F

    F --> G["Gh0st RAT Installed\nPersistence via Registry / Services\nRAT Binary Often Disguised as\nLegitimate System Process Name"]

    G --> H["C2 Beacon Established\nRegular Check-In to Hainan Server\n'Gh0st' 5-Byte Protocol Header\nTraffic Appears as Routine HTTP/S"]

    H --> I["Intelligence Collection Phase\nMonths of Silent Surveillance"]

    I --> I1["Full Desktop Control\nReal-Time Screen View\nKeyboard + Mouse Capture\nDocuments Read as Composed"]
    I --> I2["File Exfiltration\nDiplomatic Correspondence\nTravel Schedules\nDraft Communications\nClassified Embassy Documents"]
    I --> I3["Keylogging\nPasswords + Credentials\nEmail Content\nEncrypted Messaging Keys"]
    I --> I4["Webcam + Microphone\nConversations Recorded\nRoom-Level Audio Surveillance\nVideo of Physical Environment"]

    I1 --> J["Data Aggregation\nPrimary C2: Hainan Server\nSecondary C2: 3 Additional Servers\n(Commercial Hosting, Multiple Countries)"]
    I2 --> J
    I3 --> J
    I4 --> J

    J --> K["Lateral Spread\n1,295 Computers / 103 Countries\nForeign Ministries of 8+ Nations\nEmbassies in India, Pakistan, Germany, Taiwan"]

    K --> K1["Dalai Lama's Offices\nDharamsala / New York\nLondon / Brussels / Delhi\nAll Major Exile Locations Compromised"]
    K --> K2["Diplomatic Infrastructure\nIran, Bangladesh, Latvia, Indonesia\nPhilippines, Brunei, Barbados, Bhutan\nForeign Ministries + Embassy Workstations"]
    K --> K3["Civil Society Organizations\nTibetan Rights Groups\nHuman Rights Monitors\nJournalists Covering China"]

    K1 --> L["Intelligence Output\nVisa Applications Denied in Advance\nDiplomatic Meetings Forewarned\nInternal Strategies Compromised\nDalai Lama Movements Anticipated"]

    L --> M["2008: Tibetan Staff Notice Interceptions\nReach Out to Information Warfare Monitor\nCitizen Lab + SecDev Group Engage"]

    M --> N["Researcher Arrival: Dharamsala\nNart Villeneuve + Rafal Rohozinski\nDirect Network Analysis\nGh0st RAT Discovered on Multiple Machines"]

    N --> O["C2 Enumeration\nAttackers' Own Admin Interface Probed\nFull List of 1,295 Victims Revealed\nHainan Primary Server Identified"]

    O --> P["March 28, 2009\nInformation Warfare Monitor Publishes\n'Tracking GhostNet' Report\nFirst Comprehensive APT Documentation"]

    P --> Q["Chinese Government Response\n'Irresponsible Accusations'\nFormal Denial of All Involvement\nNo Technical Rebuttal Offered"]

    Q --> R["🔴 Global Security Impact\nFirst Public APT Framework\n4 Years Before Mandiant APT1\nNew Paradigm: State Cyber Espionage vs Civil Society"]

    R --> S["2010: Shadow Network\nCitizen Lab Follow-Up Investigation\nClassified Indian Military Documents Found\nExpanded Scope of Same Operation"]