GhostNet: The Chinese Espionage Network That Compromised 1,295 Computers in 103 Countries and Could Watch Through Your Webcam

2026-08-09-15 min read

#ghostnet#china#gh0st-rat#citizen-lab#tibetan#espionage#embassy#webcam#remote-access#civil-society#dalai-lama

In March 2009, a research team at the Citizen Lab at the University of Toronto published a report that changed how the world understood state-sponsored cyber espionage. Researchers had been investigating malware found on the computers of Tibetan government-in-exile offices at the request of the Dalai Lama's organization. What they found was not a targeted Tibetan campaign - it was the command-and-control infrastructure of a global espionage network that had compromised computers in 103 countries, including foreign ministries, embassies, the offices of the Dalai Lama, a NATO computer, and the computer networks of the Indian government.

The network was named GhostNet. The Citizen Lab researchers followed the malware to its C2 servers, which were predominantly hosted in China, and documented the network systematically. GhostNet gave its operators real-time access to infected computers - not just file theft but live remote desktop viewing, microphone activation, and camera activation. Foreign embassies and ministries were being watched in real time. Sensitive diplomatic communications were being read as they were written. And this had been operating, undetected, for years.

Discovery and Scope

The Citizen Lab investigation began when the Tibetan government-in-exile asked for help investigating suspected compromises of their computer systems in 2008. Researchers found a sophisticated RAT (Remote Access Trojan) on Tibetan networks that communicated with external C2 infrastructure. Following the C2 infrastructure led to a larger network than anyone had expected.

The GhostNet report documented 1,295 infected computers across 103 countries. Targets included foreign ministries of Iran, Bangladesh, Latvia, Indonesia, Philippines, Brunei, Barbados, and Bhutan; embassies of India, South Korea, Indonesia, Romania, Cyprus, Malta, Thailand, Taiwan, Portugal, Germany, and Pakistan; the ASEAN (Association of Southeast Asian Nations) Secretariat; SAARC (South Asian Association for Regional Cooperation); the Asian Development Bank; and numerous NGOs and Tibetan organizations. Approximately 30% of the infected computers were described as "high-value" targets.

[TECHNICAL NOTE]

GhostNet's malware - primarily a tool called gh0st RAT (which the Citizen Lab tracked via its network beacon characteristics) - was a fully functional Remote Access Trojan providing extensive capability on infected systems. Operators could browse the file system, download or upload files, take screenshots, activate the webcam, activate the microphone for audio recording, and view the live remote desktop in real time. The C2 communication was encrypted. Infection vectors included spear-phishing emails with malicious attachments targeted specifically at Tibetan, diplomatic, and governmental contacts - the emails were crafted to be contextually relevant to the specific recipient. The GhostNet report documented a case where the Tibetan government-in-exile sent an invitation to a conference to a diplomat; the diplomat's computer was already infected when they received it, meaning the attacker could read the invitation. The attacker then sent a separate follow-up email to the diplomat appearing to come from the Tibetan organization, with a malicious attachment. The ability to read diplomatic correspondence and use that context to craft more convincing follow-up attacks - a form of what would now be called Business Email Compromise using live intelligence - demonstrated a level of operational sophistication that had not been publicly documented at that scale before 2009.

Attribution and China

The Citizen Lab was careful in its attribution language. The report noted that C2 infrastructure was predominantly in China (with some servers on Hainan Island, the location of a major PLA signals intelligence facility) and that the targeting pattern was consistent with Chinese government intelligence interests - heavy focus on Tibetan organizations, the Dalai Lama's office, and diplomatic targets in countries with significant China policy relevance. The report did not formally attribute GhostNet to the Chinese government, noting that the evidence was circumstantial and that attribution of state-sponsored operations through purely technical analysis had inherent limitations.

Chinese government officials denied involvement. Independent security researchers who analyzed the GhostNet infrastructure and malware concluded the targeting pattern was consistent with Chinese state intelligence collection priorities. The general consensus in the security research community was that GhostNet represented either state-directed or state-tolerated collection on behalf of Chinese intelligence interests, even if the direct chain of command could not be established.

[WARNING]

The GhostNet report had several lasting effects on how governments and civil society organizations thought about cyber espionage. First, it demonstrated that sophisticated state-level espionage was not limited to government-to-government targeting - diplomatic organizations, NGOs, religious organizations, and diaspora communities were as much targets as formal government networks, and often had significantly weaker security. Second, it showed that academic researchers (Citizen Lab, later joined by others including iSight Partners, Mandiant, and FireEye) could conduct independent attribution research of a quality comparable to national intelligence services, and that this research could be published publicly. This created a category of public cyber threat intelligence that had not previously existed. Third, the live audio and video access capabilities documented in GhostNet - not just file theft but real-time room monitoring through compromised computers - changed the risk calculus for anyone handling sensitive matters near a potentially compromised machine. The awareness that an infected laptop could be a surveillance device recording conversations drove changes in operational security practices for sensitive organizations that had not previously considered physical sound security in the context of cyber threats.

Shadow Network and Subsequent Research

Citizen Lab followed the GhostNet report with a 2010 investigation called "Shadows in the Cloud" that documented a separate but related espionage network - also using Chinese C2 infrastructure - that had compromised Indian government and military systems, the offices of the Dalai Lama, and computers belonging to United Nations, diplomatic corps, and business interests across South Asia. This network was stealing documents including classified Indian government documents and sensitive Dalai Lama correspondence.

The GhostNet and Shadow Network investigations established the Citizen Lab as the primary public research institution for documenting state-sponsored cyber espionage against civil society, a role it has continued through subsequent investigations of NSO Group's Pegasus spyware, Chinese operations against Uyghur communities, and numerous other campaigns where the targets were civil society organizations rather than government or military systems.

[IOC]

GhostNet summary: published March 29, 2009 by Information Warfare Monitor (Citizen Lab, University of Toronto / SecDev Group). Investigation origin: malware analysis request from Tibetan government-in-exile organizations. Network scope: 1,295 infected computers in 103 countries. High-value targets: approximately 30% of infected systems. Specific confirmed targets: offices of the Dalai Lama, embassies of 13+ nations, foreign ministries of 8+ nations, ASEAN Secretariat, SAARC, Asian Development Bank, NATO (one computer), Indian government networks. Primary malware: gh0st RAT (Chinese-language RAT with full remote control including audio/video). C2 infrastructure: predominantly China-hosted; significant servers on Hainan Island (location of PLA SIGINT units). Attribution language: "consistent with Chinese government interests" (Citizen Lab); Chinese government denied involvement; no formal government attribution made at time of publication. Operational capability: real-time remote desktop, file access, microphone activation, webcam activation - live surveillance not just file exfiltration. Duration: estimated multi-year operation before discovery. Significance: first publicly documented global state-level espionage network; introduced concept of sophisticated civil society targeting; established public cyber threat intelligence research as a field. Follow-on: Shadows in the Cloud (2010) documented related network targeting Indian military and Dalai Lama offices with classified document theft.