On April 29th, since 2018, there have been many security vendors in China that have discovered multiple virus Trojans such as worms and wolves. These Trojans use pirated Ghost systems to spread the door and install rootkits on users' computers. A variety of popular black industries have realized profit: including cloud control to download more Trojans, mining and so on. The Tencent Security Vision Threat Intelligence Center analyzes the technical characteristics of the worms such as worms, lone wolves, double guns, purple foxes, and greedy wolves through multiple dimensions, and finally judges that the five badly affected virus gangs are behind A criminal organization manipulates. The virus gang was active in July-August 2018, when the number of infected computers was between 30 million and 40 million. After that, the spread of the virus has converged, and the amount of infection dropped between 10 million and 20 million in August-November 2018. So far, the number of computers controlled by the virus gang is still between 2 million and 3 million.