TA4922 Gh0stRAT C2 Raw TCP on Ports 80/443 with Non-HTTP Protocol

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•9

Detects outbound network communication to ports 80 or 443 that lacks standard application-layer protocol signatures (HTTP/HTTPS/TLS). This behavior is characteristic of the Gh0stRAT malware, which uses a non-standard zlib-compressed protocol with a specific 'Gh0st' header, commonly observed in TA4922 operations.