Threat actor · all actors

GhostEmperorMISP-3c3ca8f3 state

aka FamousSparrow, UNC2286, Salt Typhoon, RedMike, OPERATOR PANDA

Last updated: 2026-06-01

6attributed CVEs

0ATT&CK techniques

21.2IDF score (tooling uniqueness)

0exclusive CVEs

2018–2024years active

About this actor

GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets.

Source: MISP threat-actor catalog

Activity timeline

Find actors who…

Profile

CVE	Risk	CVSS	EPSS	Published	Products
`CVE-2024-3400` KEV	9.7	10.0	0.9432	2024-04-12	network
`CVE-2023-20198` KEV	9.6	10.0	0.9401	2023-10-16	network
`CVE-2018-0171` KEV	9.5	9.8	0.9290	2018-03-28	network
`CVE-2024-21887` KEV	9.5	9.1	0.9441	2024-01-12	application
`CVE-2023-46805` KEV	9.3	8.2	0.9437	2024-01-12	application
`CVE-2023-20273` KEV	9.0	7.2	0.9265	2023-10-25	network

Not tracked in MITRE ATT&CK (this actor has no technique associations in the STIX bundle).

Top mitigating NIST 800-53 controls (by ATT&CK technique coverage)

No mitigating-control coverage computed — actor has no MITRE ATT&CK techniques on file.

Co-occurring actors

Salt Typhoon 6 shared CVEs
Clop 2 shared CVEs
UTA0178 2 shared CVEs
Cutting Edge 2 shared CVEs
br0k3r 2 shared CVEs
RansomHouse 2 shared CVEs
Darkhotel 2 shared CVEs
Pay2Key 2 shared CVEs
Fox Kitten 2 shared CVEs
The Magic 1 shared CVE

Similar actors

Overlapping CVEs

Active in same years

APT29 4.00
Salt Typhoon 4.00
APT1 3.00
APT28 3.00
Deep Panda 3.00