https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/

https://www.sygnia.co/blog/ghost-emperor-demodex-rootkit/

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf