Gh0s7
Attribution profile
- Type
- Activist
- Location
- Thailand
- Known incidents
- 3 incidents
- Sources
- 5 sources
- First seen
- 2016-09-01
- Last seen
- 2017-01-21
- Updated
- 2026-10-11 02:10
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Gh0s7, also known as Shad0ws3c and Sc0rp10nGh0s7, is a threat actor linked to the Shad0w Security crew (Shad0wS3C) and is based in Thailand. The actor has targeted governmental organizations in India, Thailand, Mexico and Paraguay, stating objectives such as exposing security weaknesses, demonstrating the group's resurgence, retaliating against arrests of hacktivists and highlighting alleged human rights violations. Initial access has been achieved by exploiting poor credential management—including plaintext username‑password files—and by leveraging server vulnerabilities; no specific malware families or tooling are described in the sources. Publicly reported operations include the 2017 breach of India’s National Aids Research Institute that leaked HIV test data, the 2016 intrusion into Thailand’s National Statistical Office conducted in response to the #OpSingleGateway arrests, and the 2016 compromise of Mexico’s Instituto de la Función Registral del Estado México where the attacker claimed to show the team’s return. No explicit state or criminal‑conspiracy affiliation is documented.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 5 sources.