How was the GhostNet spy network discovered in 2009?

Created from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles.

The GhostNet spy network was discovered in March 2009 by researchers at the University of Toronto. The investigation began after representatives of the Dalai Lama requested an analysis of the exiled leader's computers to check for malware.1

Upon examining the systems, the researchers determined that the Dalai Lama’s computers had been compromised. Further investigation revealed that the GhostNet network had infiltrated over 1,000 computers across at least 103 countries, with a high concentration of compromised systems found in embassies and foreign affairs bureaus throughout South and Southeast Asia.1

The network operated by infecting computers through e-mail attachments or malicious web links. Once infected, the malware allowed for remote monitoring, including the ability to activate cameras and recording devices, as well as the capacity to search local networks for sensitive files. The control servers for this operation were traced to locations in China and California.1