GHOSTS Version 9 (G9) expands the platform beyond cyber simulation to include the social and cognitive domains as well.

G9 still automates realistic user behavior on systems: Browsing, email, authentication, document handling, application use, network traffic, and the artifacts expected in a populated environment, but also adds a broader model of synthetic human activity: NPCs can now hold beliefs, acquire knowledge, participate in social networks, follow workflows, and change behavior as scenarios unfold.

Highlights

Three Connected Domains

The social domain connects cyber activity to cognitive effects: Information can be created, distributed, encountered, interpreted, and acted upon within the same scenario.

NPCs Beyond the Endpoint

A scenario can include:

• Blue NPCs operating hosts
• Grey NPCs participating in synthetic environments
• Red NPCs conducting adversarial activity
• Ethereal NPCs modeled without dedicated endpoints

Beliefs, Knowledge, and Workflows

NPCs can now maintain evolving internal state, including:

• Beliefs and belief updates
• Knowledge acquisition
• Preferences
• Trust relationships
• Social connections
• Information exposure
• Workflow progression
• Optional LLM-assisted decision logic

This supports sufficient psychological realism for experimentation without requiring a complete model of human cognition.

Platform Direction

GHOSTS has evolved through a consistent progression:

Timelines → Preferences → NPCs → Social Relationships → Beliefs → Knowledge → Workflows → Multi-Domain Scenarios

G9 formalizes that shift.

GHOSTS is now a realism and actuation layer for cyber, social, and cognitive simulation. It can operate independently or as part of a broader training, experimentation, or mission-rehearsal stack.

Upgrade Notes

G9 introduces substantial architectural changes.

Before upgrading:

1. Back up the database.
2. Review and apply migrations.
3. Validate existing timelines, handlers, and NPC configurations.
4. Test current scenarios in a non-production environment.
5. Review integrations that depend on earlier API behavior.

Existing cyber-range use cases remain supported. Social and cognitive capabilities can be adopted incrementally.

8.3.1

Install From Binaries

• Windows x64

• Windows x32

• Linux

• Windows Lite

• Linux Lite

Dependency Updates

• Next.js upgraded from 14.2.26 → 15.2.4 in ghosts.ui ([#519])
• lockfile-lint-api upgraded from 5.1.6 → 5.9.2 in ghosts.pandora.socializer ([#515])
• Transformers upgraded
• ghosts.pandora: 4.46.3 → 4.48.0 ([#493])
• ghosts.shadows: 4.38.0 → 4.48.0 ([#491])
• Gradio upgraded to 5.11.0 ([#485])
• Multiple npm & pip dependency bumps across directories ([#510], [#509], [#508])

Features & Enhancements

• V8 Enhancements merged ([#518])
• UserAgentManager added to Linux client ([#514])
• Lite distro support improvements ([#513])
• Feature: YAML configuration support for clients ([#507])
• ExecuteFile handler added ([#501])
• More robust WebEmail attachments on Linux ([#497])
• RDP Wait now uses exponential backoff ([#484])
• Updated Linux client docker build system ([#476])
• Further AI and Ollama integration in Pandora ([#471])

Developer Experience / Tooling

• Grafana dashboards now use current time by default ([#511])
• Timeline controller refactor & fixes ([#502], [#495], [#489])
• Missing docs example fixed ([#488])

Security & Fixes

• Mitigated directory traversal vulnerability [XBOW-025-109] ([#492])
• Resolved checkid loop issue ([#482])
• Fixes for issues #470 and #473 ([#474], [#475])

v8.2.0.0 adds

• GHOSTS now has a UI! Manage machines and machine groups, deploy new timelines, and view activities. 😍
• GHOSTS Shadows provides integrations with an LLM for the purposes of GHOSTS agents. It provides multiple models for activities, chat, content, social, and whatever else you may need. 👻
• GHOSTS LITE is a stripped-down version of GHOSTS that is designed to be more lightweight and require less resources to run certain activities in training, exercises, and simulations. 👀
• Fixes #385 default guid 00000000-0000-0000-0000-000000000000 animator NPC bug. 🐛
• Fixes #384 client path bug. 🐛
• Fixes animation cancellation token bugs (chat). 🐛
• Updated documentation for Animations (and many other areas as well). 🤙

Windows clients for this release:

• ghosts v8.0.0 Win 64bit
• ghosts v8.0.0 Win 32bit

Linux clients for this release:

• ghosts v8.0.0 linux client

Containers

• API docker pull dustinupdyke/ghosts:latest
• docker pull dustinupdyke/ghosts-ui
• docker pull dustinupdyke/ghosts-shadows

v8.1.0.0 adds

• GHOSTS LITE - when you want to conserve resources needed and participants won't access that machine directly.
• API clean up, particularly machine updates and groups.
  • Made sample json objects easier to understand and submit the swagger generated defaults
  • API robustness
  • MachineGroups
  • Timeline delivery by machine and by group

Windows clients for this release:

ghosts v8.0.0 Win 64bit
ghosts v8.0.0 Win 32bit

Linux clients for this release:

ghosts v8.0.0 linux client

API

docker pull dustinupdyke/ghosts:latest

GHOSTS v8 👻

Windows clients for this release:

ghosts v8.0.0 Win 64bit
ghosts v8.0.0 Win 32bit

Linux clients for this release:

ghosts v8.0.0 linux client
API

docker pull dustinupdyke/ghosts:latest

What's New

• Beginning of moving to websockets — NPCs are now "always connected" 📶 and do not need to "check in" in order to execute activities, althought these are still being built out, and the old check-in system is still in place for the time being.
• Adds ability to configure random timespans to a timeline for delaybefore or delayafter some activity is executed.
• Cleans up and simplifies configuration on client and server systems (breaking change). 🤖
• Updates all framework and dependency versions to latest (.NET8).
  • NetOffice binary update, particularly negatively impacting Excel, forcing it to continually restart. Updated to latest (and new source) for NetOffice libraries across all Office products.
• Installation binaries are now baked into the API (download to client from your local installation)

Improvements

• "One docker-compose To Rule Them All" — we were seeing installs fail because of piecemeal installation of various ghosts modules. Now, there is a single docker-compose file that will install all of the necessary components for a GHOSTS system.
  • Animator and SPECTRE merged into ghosts api proper.
• Animator job management is now done through the UI.
• API endpoints have been re-organized in a more logical fashion. 🗂
• Added a favicon. 💅

Bug Fixes 🐛

• Updates Grafana docker compose to not use root.
• Cleans up containers and ensures all are amd64 (not arm!).
• Fixes a bug to get the cmd window to stay open after running a command, despite attempts to use parameters to get it to stay open.
  • Cmd now stays open, but this can have different outcomes based on the types of commands passed in, plus ghosts will reap windows in order to save on machine resources, so a used command window won't always be there later.
• New improved RDP, fixes an array of different connectivity bugs.
• Fixes bugs in delay before and after with fixed integer/long values over int maximum.
• Adds "log" level to application logs.
• Fixes documentation bug in machine group timelines.

Adds:

• initial websocket connection code to begin "always connected" agents, which allows for a faster turn around time for performing activities and coordinating things like social media, chat, etc. (this is very early, and is not production ready, this is in fact, just code to help test performance in a large environment...
• updated docker-compose that hopefully solves grafana not starting (removed root requirement)
• updates to net8.0, and all latest packages
• new ghosts logos

Windows clients for this release:

• ghosts v7.2.0 Win 64bit
• ghosts v7.2.0 Win 32bit

Linux clients for this release:

• ghosts v7.0.0 linux client

API

• docker pull dustinupdyke/ghosts:7.0.0

This version features:

Download timeline from http|s url before doing anything (if this fails, the client falls back to local). New section for this in ./config/application.json:

"TimelineConfiguration": {
        "Location": "https://raw.githubusercontent.com/cmu-sei/GHOSTS/6e04885809dfdceb138fbf9cdf1a1f795ea907ef/src/Ghosts.Client/config/timeline.json"
  },

or like this for local (basically disable download default timeline at startup):

"TimelineConfiguration": {
    "Location": "config/timeline.json",
  },

Windows clients for this release:

• ghosts v7.0.0 Win x64 client
• ghosts v7.0.0 Win x32 client

Linux clients for this release:

• ghosts v7.0.0 linux client

• API

• docker pull dustinupdyke/ghosts:7.0.0

This version features:

• Continued performance improvements
• Better clean-up of created client artifacts
• Improved Logging
• Handler enhancements for FF and Chrome Browsers, including:
  • Complete forms
  • Post payloads (images, files, etc.)
  • Better UA string handling
  • SharePoint
  • Drupal
• New Jabber (XMPP) handler
• New RDP handler
• New sFTP handler
• New SSH handler
• Client now supports AutoIT (lots of features we might add here in the future)
• Fixed issue with bad cmd config (7.0.30.0)

v 7.0.111

• Cron-like scheduling
• Deny list for emails and browser URL handling
• auto-start management
• New outlook handlers

This update requires more than the simple "update ghosts.exe and ghosts.domain.dll" due some new dependencies, but has no breaking changes (thus only the minor version revision).

• introduces Outlook handler command "click on a random link in an inbox email" (unless the link domain is in the deny list)
• introduces deny list (other features can potentially implement this in the future)

BREAKING CHANGES:

• Finally drops support for Internet Explorer (IE). I am not aware of anyone using this handler
• Updates logging to latest due to some security concerns - nlog.config must be updated
• Updates internal logging to UTC (not the timeline history, this was already UTC)

Windows Client:

• Updates dependencies, including the latest versions of chrome and gecko drivers
• Adds randomization tokens to web browsing, such as document?id={uuid}, where GHOSTS replaces this token with a UUID at runtime for better randomization of URLs
• Adds the ability to save Office documents to an array of locations for better file save randomization
• Adds better browser handling of downloads (avoids blocking modal download windows)
• Removes lower-casing of emails when searching documents for next link to browse
• Cleans up several bugs with "working hours"
• Cleans up a specific bug with port listener threads dying
• Memory use should be significantly reduced
• Fixes export of PDFs where those files would be saved in the wrong directory
• Cleans up logging
• Cleans up handling of thread aborts which happen on shutdown or timeline change
• Fixed bug with outside email addresses
• Changed the cmd paradigm to avoid typing in wrong window errors

Other:

• Adds PANDORA Server