Ghost

Ghost is an overloaded malware name used in multiple distinct contexts, including a ransomware variant, a ransomware group branding, and a separate npm-based malware campaign. High-confidence reporting ties the name to ransomware activity affecting a California water and wastewater facility in 2021, where a Ghost ransomware variant encrypted systems including SCADA-related servers. More recent reporting also uses Ghost or GhostLocker for a ransomware operation associated with GhostSec that evolved from hacktivist roots into ransomware and double-extortion activity, including rapid exploitation of newly disclosed vulnerabilities in unpatched internet-facing systems and exfiltration prior to extortion. Separately, the name Ghost has been applied to a 2026 malicious npm supply-chain campaign targeting developers with trojanized packages masquerading as useful tools. In that campaign, deceptive installation output and social engineering were used to obtain sudo credentials and deploy a remote access trojan that searched for cryptocurrency wallets and sensitive personal data, with some variants supporting broader data theft. Because these references describe materially different malware or operations sharing the same name, Ghost should be treated as an ambiguous designation rather than a single well-defined malware family.