Ghidra 12.1.2 ACE via Malicious Project/Script Import Spawning Unexpected Child Process

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects instances where the Ghidra reverse engineering tool (via java.exe or javaw.exe) spawns suspicious child processes. This behavior is considered anomalous as Ghidra typically does not require launching command shells, scripting interpreters, or other system binaries directly from its process tree. Such activity often indicates that an attacker is using the Ghidra environment to execute secondary payloads or perform post-exploitation tasks.