Threadlinqs IntelligenceStart free

Threat actorCNTracked since 2026-06

Ghost Stadium

Also known as:TA-1

As of 2026-07-30, Ghost Stadium is a CN-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning phishing. Also known as TA-1. ATT&CK coverage spans 39 techniques across 11 tactics in 2 of 2 tracked threats. Most-observed techniques: T1056.003 (Web Portal Capture), T1539 (Steal Web Session Cookie), T1566.002 (Spearphishing Link).

Tracked threats
22 high
First seen
2026-06-07
Last seen
2026-07-30
ATT&CK techniques
39across 2 of 2 threats
Related CVEs
0None referenced
Attribution
CNNation or origin
Nation: CN · 2 tracked threat(s) · Categories: PHISHING

Activity timeline

Ghost Stadium appears in 2 tracked threats between and ; the busiest month was 2026-06 with 1 report.

ATT&CK techniques observed

39 techniques observed across 2 of 2 tracked threats · Resource Development (12), Credential Access (6), Reconnaissance (5), Command and Control (4), Initial Access (4), Impact (2)
  • T1056.003 Web Portal Capture — Credential Accessobserved in 2 of 2 tracked threats
  • T1539 Steal Web Session Cookie — Credential Accessobserved in 2 of 2 tracked threats
  • T1566.002 Spearphishing Link — Initial Accessobserved in 2 of 2 tracked threats
  • T1583.001 Domains — Resource Developmentobserved in 2 of 2 tracked threats
  • T1657 Financial Theft — Impactobserved in 2 of 2 tracked threats
  • T1684.001 Impersonation — Stealth (formerly Defense Evasion)observed in 2 of 2 tracked threats
  • T1005 Data from Local System — Collectionobserved in 1 of 2 tracked threats
  • T1036.005 Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 1 of 2 tracked threats
  • T1071.001 Web Protocols — Command and Controlobserved in 1 of 2 tracked threats
  • T1090.002 External Proxy — Command and Controlobserved in 1 of 2 tracked threats
  • T1098 Account Manipulation — Persistenceobserved in 1 of 2 tracked threats
  • T1102 Web Service — Command and Controlobserved in 1 of 2 tracked threats
  • T1102.002 Bidirectional Communication — Command and Controlobserved in 1 of 2 tracked threats
  • T1110.004 Credential Stuffing — Credential Accessobserved in 1 of 2 tracked threats

Tracked threats