Kaspersky's Mark Lechtik, Aseel Kayal, Paul Rascagneres and Vasily Berdnikov wrote in a long blog post — which also included a separate list of technical details — that the actor used a rootkit which had been adapted to work on Windows 10. The rootkit was given the name Demodex.

This was loaded using the kernel mode component of an open source project known as Cheat Engine in order not to be stopped by the Windows Drive Signature Enforcement that has been put in place by Microsoft as a safety valve.

The research is not totally new as Kaspersky announced some basic details back in July. The fleshed out version was presented at the company's annual Security Analyst Summit which was held this week.

Also on the attackers' list were organisations in Egypt, Ethiopia and Afghanistan, with some of these targets having strong ties to south-east Asian countries.

"This means that the attackers might have leveraged those infections to spy on the activities in countries that are of geopolitical interest to them," the researchers wrote.

GhostEmperor was found to mainly use hosting services based in Hong Kong and South Korea, such as Daou Technology or Anchent Asia.

The researchers gave as one reason for their attribution the attackers use of open-source tools such as Ladon or Mimikat_ssp that are popular among such actors.

"Additional data points such as version info found within the resource section of second stage loader binaries included a legal trademark field with a Chinese character: ‘Windows庐 is a registered trademark of Microsoft Corporation'," they said.

Additionally, some similarities were noticed between Demodex and the Derusbi toolkit which has also been used by Chinese-speaking actors.

"GhostEmperor is an example of an advanced threat actor that goes after prominent targets and aims to maintain a longstanding and persistent operation within their environments," Lechtik, Kayal, Rascagneres and Berdnikov wrote.

"We observed that the underlying actor managed to remain under the radar for months, all the while demonstrating a finesse when it came to developing the malicious toolkit, a profound understanding of an investigator’s mindset and the ability to counter forensic analysis in various ways."