Actor Profile

GhostTree is a threat actor that has developed an evasion technique exploiting recursive NTFS junctions to bypass antivirus scanning. The actor targets the information technology sector and leverages inherent Windows file system features to create infinite directory structures that overwhelm security tools. The motivation appears to be enabling malware persistence by preventing completion of folder-based security scans, particularly those conducted by Microsoft Defender. The origin and broader attribution of GhostTree remain limited based on available reporting.

TTPs (Tactics, Techniques, Procedures)

GhostTree employs defense evasion techniques centered on abusing legitimate Windows NTFS junction functionality. The primary TTP involves creating recursive NTFS junctions (T1564.004: Hide Artifacts: NTFS File Attributes) to generate exponentially large numbers of valid file paths within the file system. This technique forces Microsoft Defender and potentially other security products into indefinite scanning loops when performing folder-based scans (T1562.001: Impair Defenses: Disable or Modify Tools). By exploiting this file system feature, the actor effectively renders security scanning incomplete, allowing malware to remain undetected on compromised systems. This represents a novel approach to antivirus evasion that does not require privilege escalation or direct modification of security software.

Targets & Patterns

GhostTree targets the information technology sector, likely focusing on organizations heavily reliant on Microsoft Windows environments and Microsoft Defender for endpoint protection. The targeting pattern suggests the actor seeks environments where default security configurations depend on file system scanning for malware detection. The choice of IT sector victims may reflect the presence of valuable intellectual property, access to downstream customer networks, or the potential for supply chain compromise. The technique's effectiveness is maximized in environments using Microsoft Defender without additional behavioral detection layers, making organizations with limited security tool diversity particularly vulnerable.

Historical Context

The GhostTree NTFS junction abuse technique represents an evolution in defense evasion tactics that exploit legitimate operating system features rather than software vulnerabilities. While NTFS junctions and symbolic links have been previously documented in MITRE ATT&CK for privilege escalation and persistence, the application of recursive junctions specifically to create infinite scan loops appears novel. This technique shares conceptual similarities with historical "zip bomb" and decompression bomb attacks that overwhelmed antivirus engines, but adapted for modern file system-based scanning. No direct linkage to previous named campaigns or established APT groups is evident from available data, suggesting GhostTree may represent a newly identified actor or a tactical innovation by an existing group operating under new infrastructure.

Defensive Recommendations

  • Configure Microsoft Defender and other AV solutions to implement scan depth limits and timeout thresholds to prevent infinite scanning loops when encountering recursive directory structures
  • Monitor for creation of NTFS junctions and reparse points (fsutil behavior query SymlinkEvaluation) and alert on unusual recursive junction patterns, particularly in user-writable directories
  • Deploy behavioral detection and EDR solutions that do not rely solely on file system scanning, enabling detection of malicious activity even when static scanning is evaded (T1562.001 mitigation)
  • Implement file system integrity monitoring to detect creation of junction points in sensitive directories, using tools like Sysmon Event ID 12/13 to track registry and file system modifications
  • Apply principle of least privilege to limit user ability to create junction points in system directories, and audit existing junctions using 'dir /AL /S' commands across critical paths