Ghost, also known as Cring, does not need new vulnerabilities: it breaks in through flaws that were patched years ago and can encrypt a network on the day it gets in. The FBI, CISA and MS-ISAC joint #StopRansomware advisory AA25-050A, published on 19 February 2025, says Ghost actors located in China have compromised organisations in more than 70 countries since early 2021, using public exploits for Fortinet, Adobe ColdFusion, Microsoft SharePoint and Exchange. This profile is for vulnerability management owners, Windows and Active Directory administrators, and incident responders in public sector, education, healthcare, manufacturing and small and medium-sized businesses. It covers names, targeting, ATT&CK techniques, how the group uses accounts and credentials, notable cases and a defence plan. The wider ransomware landscape is in the Ransomware Groups Guide.
Key takeaways
- Old CVEs are the entry point. AA25-050A lists CVE-2018-13379 (FortiOS), CVE-2009-3960 and CVE-2010-2861 (ColdFusion), CVE-2019-0604 (SharePoint) and the ProxyShell chain CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207 (Exchange). All are in the CISA KEV catalog.
- Dwell time is days, sometimes hours. The advisory says the actors typically spend only a few days on a network and in multiple cases deployed ransomware on the same day as initial compromise, so detection has to be fast and automated.
- The ransom note overstates the theft. Notes threaten to sell stolen data, but the agencies say Ghost actors do not frequently exfiltrate significant amounts of sensitive data; validate before reacting to the threat.
- Credentials turn one host into a domain. The group uses Mimikatz, Group Policy Preferences password extraction (CVE-2014-1812) and ZeroLogon (CVE-2020-1472) tools, and creates or changes local and domain accounts.
- Names change, tradecraft does not. The actors rotate payloads, file extensions, ransom note text and contact addresses, so detection by indicator alone fails.
Who they are (names and aliases)
AA25-050A states that Ghost actors, located in China, conduct these attacks for financial gain, and that attribution has varied over time because the actors frequently rotate their ransomware executables, file extensions, ransom note text and email addresses. The advisory lists these names used for the group: Ghost, Cring, Crypt3r, Phantom, Strike, Hello, Wickrme, HsHarada and Rapture. Ransomware executables named in the advisory include Cring.exe, Ghost.exe, ElysiumO.exe and Locker.exe. The group does not have a MITRE ATT&CK group entry in v20.
| Attribute | As stated by AA25-050A |
|---|---|
| Location and motive | Located in China; financial gain |
| Active since | Early 2021; FBI observations as recent as January 2025 |
| Reach | More than 70 countries |
| Ransom demand | Tens to hundreds of thousands of US dollars in cryptocurrency |
| Contact | Encrypted email services (Tutanota, ProtonMail, Onionmail, Mailfence and others); TOX IDs since about August 2024 |
| Model | Opportunistic: victims chosen by exposed vulnerable systems |
The name Cring was used in earlier reporting: Kaspersky ICS CERT described Cring attacks on European industrial enterprises in the first quarter of 2021 through unpatched FortiGate VPN servers. See the Ransomware Family Lineage and Rebrands Guide for how rebrands complicate tracking.
Targeting and motivation
- Sectors: AA25-050A lists critical infrastructure, schools and universities, healthcare, government networks, religious institutions, technology and manufacturing companies, and numerous small and medium-sized businesses.
- Selection: opportunistic. Organisations are hit because an internet-facing system runs outdated software and firmware, not because of who they are.
- Industrial impact: Kaspersky reported that in at least one 2021 case the encryption of servers controlling an industrial process caused a temporary shutdown of the process. See the OT Ransomware Response Playbook.
- Motivation: financial, through encryption and extortion; data theft is limited.
Tactics and techniques (MITRE ATT&CK)
Techniques are from AA25-050A. Where the advisory used IDs that ATT&CK v20 has since revoked, NHI Mgmt Group gives the current v20 equivalent.
| Tactic | Technique | How it shows up |
|---|---|---|
| Initial access | T1190 Exploit Public-Facing Application | FortiOS, ColdFusion, SharePoint and Exchange CVEs listed above |
| Execution | T1059.001 PowerShell; T1047 Windows Management Instrumentation | Cobalt Strike Beacon delivered by PowerShell; WMI for remote commands |
| Persistence | T1136.001 Local Account; T1136.002 Domain Account; T1098 Account Manipulation; T1505.003 Web Shell | New local and domain accounts, changed passwords on existing accounts, web shells on web servers in 2024 |
| Privilege escalation | T1068 Exploitation for Privilege Escalation; T1134.001 Token Impersonation/Theft | BadPotato, GodPotato and other open source privilege escalation tools |
| Credential access | T1003 OS Credential Dumping; T1552.006 Group Policy Preferences | Mimikatz; SharpGPPPass for CVE-2014-1812 |
| Lateral movement | T1210 Exploitation of Remote Services | SharpZeroLogon against domain controllers (CVE-2020-1472) |
| Discovery | T1087.002 Domain Account; T1135 Network Share Discovery; T1518.001 Security Software Discovery | SharpShares, Ladon 911, SharpNBTScan; listing antivirus to disable it |
| Defence impairment | T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs | PowerShell to disable Microsoft Defender real-time and behaviour monitoring; clearing event logs |
| Stealth | T1564.003 Hidden Window | Hidden PowerShell windows |
| Exfiltration | T1041 Exfiltration Over C2 Channel; T1567.002 Exfiltration to Cloud Storage | Limited downloads to Cobalt Strike team servers; limited use of Mega.nz |
| Impact | T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery | Encryption and deletion of Volume Shadow Copies |
How they abuse identities and credentials
Ghost intrusions are short, so each credential step happens quickly. Each one depends on a weakness in account hygiene that can be fixed before an incident.
| Credential step | Source | Control that breaks it |
|---|---|---|
| VPN credentials read in cleartext from an unpatched FortiGate (CVE-2018-13379), tested days before the attack | Kaspersky ICS CERT, 2021 | Patch, then reset every VPN password that existed on a vulnerable version; require phishing-resistant MFA on VPN |
| Mimikatz used to steal credentials of users who had logged on to the first machine, leading to a domain administrator account | Kaspersky ICS CERT; AA25-050A | Administrators never log on to ordinary servers or workstations; tiered admin accounts; Credential Guard where supported |
| Passwords recovered from Group Policy Preferences files in SYSVOL | AA25-050A (SharpGPPPass, CVE-2014-1812) | Search SYSVOL for cpassword, delete the files and rotate the passwords; use Windows LAPS for local administrator passwords |
| ZeroLogon against domain controllers | AA25-050A (SharpZeroLogon) | Patch CVE-2020-1472 and confirm Netlogon enforcement mode |
| New local and domain accounts; passwords changed on existing accounts | AA25-050A | Alert on account creation and on password resets by unexpected actors; review privileged groups daily during an incident |
| Domain policy that let every user log on to every system | Kaspersky ICS CERT | Restrict logon rights by tier and role so one stolen account cannot reach everything |
- Machine and service accounts: local administrator accounts with the same password on many hosts, and service accounts with domain administrator rights, are what credential dumping finds first. See the Windows LAPS Guide and the Service Account Security Guide.
- Backups depend on identity: if the backup console uses domain credentials, a domain administrator compromise reaches the backups too. See the Backup Identity Isolation Guide.
Notable incidents
| Date | Event | Source |
|---|---|---|
| First quarter 2021 | Cring attacks on European industrial enterprises through FortiGate CVE-2018-13379; at least one industrial process temporarily shut down | Kaspersky ICS CERT, 7 April 2021 |
| Early 2021 onwards | Indiscriminate attacks on organisations with outdated internet-facing software in more than 70 countries | AA25-050A |
| About August 2024 | TOX IDs added to ransom notes as a contact method | AA25-050A |
| 19 February 2025 | FBI, CISA and MS-ISAC publish #StopRansomware: Ghost (Cring) Ransomware | AA25-050A |
Victim names are not published in the advisory. No incident on the NHI Mgmt Group breach database is attributed to Ghost at the time of writing.
Detection and defence
Detection signals
| Signal | Where | Notes |
|---|---|---|
| PowerShell commands changing Defender preferences (for example disabling real-time monitoring) or hidden-window PowerShell | PowerShell script block logging (Event ID 4104), Defender events | Defender tamper protection blocks many of these changes; alert on attempts |
| Event log cleared (Security Event ID 1102, System Event ID 104) | Forwarded Windows events | Forward logs centrally so clearing cannot hide earlier events |
| Volume Shadow Copy deletion | EDR, process creation | Late-stage signal: isolate the host immediately |
| New local or domain accounts (Event IDs 4720) and password resets (4724) outside change windows | Domain controllers and member servers | Persistence named in the advisory |
| Potato-style privilege escalation, Mimikatz or Cobalt Strike behaviour | EDR | Behavioural detections are more durable than hashes |
| Netlogon events showing vulnerable connections (Event ID 5829) or ZeroLogon attempts | Domain controllers | Should not occur once enforcement mode is active |
| Unexpected binaries such as HFS or reverse proxy tools on servers | EDR, application control logs | Staging and tunnelling |
Defence plan
- This week: scan your internet-facing estate for every CVE listed in AA25-050A. Patch or take offline anything vulnerable, and reset credentials on any FortiGate that ran a vulnerable FortiOS version.
- This month: confirm offline or segmented known-good backups exist and that a restore has been tested; separate backup administration from the domain.
- This month: remove GPP passwords from SYSVOL, deploy Windows LAPS, and confirm CVE-2020-1472 enforcement on all domain controllers.
- This quarter: require phishing-resistant MFA for privileged and email accounts, as the advisory recommends; restrict logon rights by tier; turn on Defender tamper protection.
- This quarter: apply application and script allowlisting in audit mode first, review blocked events for two weeks, then enforce on servers; disable unused ports, including RDP (3389), FTP (21) and SMB (445) from the internet.
Rollback: application control in enforce mode can stop business software; keep the audit policy ready to redeploy and fix rules rather than disabling control entirely.
Small and large organisations
- Small organisations without a SOC: the highest-value actions are patching or replacing the exposed systems, unique local administrator passwords, MFA on remote access and email, and an offline backup. Same-day encryption leaves little time for a human to respond, so rely on prevention and EDR automatic isolation.
- Large organisations: the risk sits in forgotten assets, such as an old ColdFusion server or an unmanaged branch firewall. Reconcile external scan results with the asset inventory monthly and give every exposed system a named owner.
Metrics
- Internet-facing systems vulnerable to any KEV-listed CVE: target zero.
- Days to patch KEV-listed CVEs on internet-facing systems: trending down, with a set target.
- Hosts with unique local administrator passwords managed by LAPS: target 100 per cent.
- Last successful full restore test: within the last quarter.
- Mean time from first alert to host isolation: measured in minutes, given same-day encryption.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SI-2 Flaw Remediation, CM-7 Least Functionality, SC-7 Boundary Protection | Patching and reducing exposed services |
| NIST SP 800-53 Rev. 5 | AC-6 Least Privilege, IA-2 Identification and Authentication, CP-9 System Backup | Credential and recovery controls |
| NIST CSF 2.0 | PR.PS-02, PR.DS-11, RC.RP-01 | Software maintenance, protected and tested backups, executing recovery |
For response, follow the Ransomware Response and Recovery Guide.
Practitioner checklist
- Check every CVE in AA25-050A against your external attack surface today.
- Reset VPN credentials on any appliance that ran a vulnerable version, even after patching.
- Delete Group Policy Preferences password files and rotate the affected passwords.
- Deploy Windows LAPS and remove shared local administrator passwords.
- Confirm Netlogon enforcement mode on every domain controller.
- Enable Defender tamper protection and alert on attempts to change Defender settings.
- Forward Windows event logs centrally and alert on log clearing and shadow copy deletion.
- Keep offline or segmented backups and test a restore every quarter.
Standards and references
- FBI, CISA and MS-ISAC: #StopRansomware: Ghost (Cring) Ransomware, AA25-050A
- Kaspersky ICS CERT: Vulnerability in FortiGate VPN servers is exploited in Cring ransomware attacks
- CISA: Known Exploited Vulnerabilities Catalog
- MITRE ATT&CK: Exploit Public-Facing Application
- MITRE ATT&CK: Unsecured Credentials: Group Policy Preferences
- MITRE ATT&CK: Data Encrypted for Impact
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Ransomware Groups Guide · FortiGate Hardening Guide · Microsoft Exchange Server Security Guide · Ransomware Prevention Guide