Gh0st

This article's factual accuracy is disputed. See the article's talk page for the relevant discussion.

 

This article or section needs additional references for verification. You can help by adding citations to reliable sources.

 

Gh0sT (also known as Gh0$T) is a RuneScape hacker. He is responsible for the hacking of tens of thousands of accounts all within a three to four month period. 

History

2008: Gh0sT begins hanging around with Elvy666 and PlsNoFatChix (and they begin hacking together). Gh0sT and PlsNoFatChix stay in the background, leaving Elvy to take the limelight for the hackings.

Early 2010: In early 2010 Gh0st begins hanging around with fellow hacker Fr0 and was found to be a hardcore user of HackForums with over 25 posts per day, on average and multiple purchases from the website. Gh0st and Fr0 were quite famous in the clan world for ddosing Reign of Terror's rival clans websites at the request of Mattbrazil_2 (Also known as Horse). These rival clans include Violent Resolution, Damage Incorporated, Ancient Fury and Brutality. Later on, Reign of Terror was put under some heat in the crash war and Gh0st and Fr0 joined RoT upon request to help them in game, as ddosing wasn't enough. Reign of Terror tried to start beef with Runescape Dinasty and Mattbrazil_2 requested Gh0st and fr0's services, which lead to RSD's IRC server (SeersIRC) being ddosed for several weeks in attempt to blackmail SeersIRC staff into kicking RSD off their IRC.

Summer 2010: Gh0sT has been hacking for quite a long time, but recently released his own tool on his former website gh0st.me. The tool was a virus written in Java (an odd combination) known as StealthBot. It was originally an IRC based botnet, which eventually evolved into HTTP and then finally (and probably still currently is) P2P. StealthBot had many features in it's early stages, but the selling point was the stealers that had been written for the various RuneScape bots, which at the time were: RSBot, Epicbot, and Nexus (iBot). 

October 2010: After being in the clan world for several months, in October, for whatever reason both Gh0st and Fr0 hack the accounts of fellow Reign of Terror members, hacking 6 people in total for a total of 7 billion GP which lead to Mattbrazil_2 kicking them from the clan. In return, Gh0st and Fr0 got some payback on Mattbrazil by ddosing Reign of Terror and by extension, Divine Forces forums for three months straight. 

Fall 2010: Gh0sT begins marketing StealthBot to script kiddies across the RuneScape hacking scene.

December 2010: Gh0sT manages to hack RSBot and replace the download link with a bot client that also downloads his StealthBot to the bot user's computer. It is a big deal because it was the largest bot site at the time. The hack goes unnoticed for a month, only to later be removed when Gh0sT makes a public announcement about it. 

January 2011: It is during this time, Jagex has announced that it will be releasing free trade. Gh0sT and his community of Gh0sT.ME use this to their advantage. Gh0sT (and his community) decides to save all of the accounts they have hoarded over the past month for when after free trade is released. It is also sometime during this month that his IRC network (all servers) get their DNS terminated. It is unknown if this was just the domain registrar acting against the botnet, or a government agency. It was at this time that StealthBot went P2P and switched to a web panel.

July 2011: In July, a user on hacking.rs had an argument with Gh0st over Casper and ddosed the Gh0st.me website. Gh0st did not take too kindly to this action and returned the attack on hacking.rs website, keeping the site down for almost two weeks.

The mass hacking of 2011

February 1st, 2011 and the months to follow it are not days that botters from back then will forget. The entire botting community was in chaos due to the rise of a superior bot known as RSBuddy... and the fact that everyone was getting hacked. Gh0sT and his community started their hackings on day one. There is no exact number of accounts that were hacked, but it is known that Gh0sT himself had over 65,000 accounts in his logs.

Gh0sT had decided to stream his hackings on the popular broadcasting site known as TinyChat. On this stream, it is rumored that he dumped about 5,000 accounts publically for people watching his stream to go through. Now, every hacker seems to exaggerate how much they have actually hacked... Gh0sT claims in total (from hacking and StealthBot\Casper sales) he made about 180B, and sold it all for a little less than $1,000,000 USD. Which he used the money to buy a house, a car, and pay for his degree.

The Birth of Casper

In mid 2011, Gh0sT released a new tool known as Casper. Casper was essentially StealthBot, but completely rewritten. StealthBot was originally an IRC botnet that had been quickly modded to use HTTP after the IRC servers were shut down. Casper was his remedy to his customers. The following images is from a Hacking.RS post in which Gh0sT had showed off his Casper Panel:

Casper was not just your ordinary virus though. In April of 2011, Gh0sT released Casper v2.0 which included something never before seen in a RuneScape virus... it used something known as a "java agent" to forcefully inject itself into the victim's Java. From there it used reflection to grab the following data from a victims runescape client: Username, password, bank pin, and bank contents. If one used RuneScape in a bot, or in your browser, or in any client that used Java (with the exception of the official RS client), Casper was able to get your details, including your bank pin, and all of the items in your bank, with 100% accuracy. Casper lived on for nearly a year.

The End of an Era

In 2012, Gh0sT closed his communities doors for good. Some people believe it was because he had been doxed, and his information was leaked; however, Gh0sT himself said that the dox of him only had his first name, his state, and his birthday correct. He says he shut down Gh0sT.me because hacking was "no fun anymore." That Casper had made it too easy, and hacking had become like a chore. He was also heard saying on TinyChat that there is no knowledge to be gained from hacking, it is all the same trivial steps. If you want to really learn how to program, hacking (in the sense of stealing RSGP) is not the way to go, make something productive, something that has never been made before, then you will actually learn something.

Osbuddy client blackmail scandal

In attempt to transform from the man he used to be, he began using the nickname "Matthew" everywhere and let the persona "Gh0st" die off into the lime light, however the transformation didn't last very long as Matthew (Gh0st) went back to his same old self during his time as Osbuddy (Orion) developer. Roughly a few months into being a developer for the oldschool runescape client Osbuddy, Matthew reached out to someone who did not take too kindly to the client in attempt to blackmail him, using data obtained from the oldschool runescape client Osbuddy.

More information can be found over at Reddit: https://www.reddit.com/r/2007scape/comments/29i75b/orion_blackmailing_attempt_warning_heads_up_about/