GhostEmperor is a threat group first discovered and described by Kaspersky in 2021. It has not been recognized since. In a late 2023 compromise investigation, Sygnia discovered what it believes to be a variant of the GhostEmperor infection chain leading to the Demodex rootkit – which was first seen and described by Kaspersky in 2021….