Loading story…
Check Point Research attributed a set of tightly scoped cyber-espionage campaigns against government and law enforcement organizations in Southeast Asia to a China-linked activity cluster it tracks as Amaranth-Dragon, assessed as connected to the broader APT41 ecosystem. Targeting was reported across Cambodia, Thailand, Laos, Indonesia, Singapore, and the Philippines, with lures aligned to local geopolitical events and infrastructure configured for stealth, including geofencing so command-and-control only interacted with victims in specific countries. The intrusion chain evolved over 2025, and—shortly after public disclosure—began weaponizing the WinRAR vulnerability CVE-2025-8088 via malicious RAR archives to achieve code execution and persistence.
Reporting describes Amaranth-Dragon using a custom Amaranth Loader to deliver encrypted payloads, with C2 infrastructure shielded behind Cloudflare and use of legitimate services (e.g., Dropbox) to stage content; Check Point also documented deployment of the Havoc C2 framework and a newly tracked TGAmaranth RAT that uses Telegram bot-based C2 and includes anti-EDR/anti-AV features. Separate coverage notes CVE-2025-8088’s exploitation mechanics (including abuse of Windows Alternate Data Streams (ADS) to write to arbitrary locations such as Startup paths) and that multiple other threat groups have also exploited the flaw, underscoring ongoing operational risk beyond this single actor.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On February 4, 2026, Check Point Research published its findings on Amaranth-Dragon, detailing the 2025 Southeast Asia espionage campaigns, rapid exploitation of CVE-2025-8088, use of Amaranth Loader and Havoc C2, and the TGAmaranth RAT. The report also highlighted Cloudflare-fronted, geo-fenced infrastructure and assessed links to the APT41 ecosystem.
In a later 2025 campaign focused on Indonesia, the group delivered a newly documented malware family called TGAmaranth RAT using password-protected RAR files, sometimes hosted on Dropbox. The RAT used a Telegram bot for command-and-control and included anti-debugging and anti-EDR/AV features.
Less than ten days after CVE-2025-8088 became public, Amaranth-Dragon incorporated malicious RAR archives exploiting the flaw into its espionage operations. The exploit allowed the attackers to drop scripts into the Windows Startup folder and sometimes add Registry Run keys for persistence.
The WinRAR Windows path traversal vulnerability CVE-2025-8088 was publicly disclosed on August 8, 2025. Public exploit availability enabled threat actors to begin weaponizing the flaw for malicious archive-based intrusion chains.
Before adopting the WinRAR exploit, Amaranth-Dragon used ZIP archives containing .LNK and .BAT files to decrypt and execute its custom Amaranth Loader. The loader then fetched encrypted payloads from command-and-control infrastructure, often leading to in-memory deployment of Havoc C2.
Throughout 2025, the China-linked cluster tracked as Amaranth-Dragon targeted government and law-enforcement organizations in Southeast Asia using lures tied to local political and geopolitical events. The activity was later assessed as closely linked to, or part of, the APT41 ecosystem based on tooling, tradecraft, and operational indicators.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
**Google Threat Intelligence Group (GTIG)** reported ongoing, widening exploitation of a high-severity WinRAR path traversal flaw, **CVE-2025-8088**, roughly six months after it was disclosed and patched by RARLAB. GTIG assessed exploitation began as early as **July 18, 2025** (including activity nearly two weeks before the vendor fix) and has expanded across a diverse set of adversaries, spanning **Russia- and China-linked espionage actors** as well as **financially motivated cybercriminals**. Reported targeting includes military, government, and technology organizations, with multiple Russia-aligned operations focusing on **Ukrainian** entities. Technical reporting indicates the vulnerability abuses **Windows Alternate Data Streams (ADS)** within crafted archives to perform directory traversal and write files to arbitrary locations, including the Windows **Startup** folder for persistence. GTIG and other researchers describe exploit chains where a user opens a benign decoy (e.g., a PDF) while hidden ADS entries extract and drop executable content such as `LNK`, `HTA`, `BAT`, `CMD`, or script files that run at login; observed payloads include **remote access trojans, infostealers**, and malware frameworks used by named state actors (e.g., **RomCom/UNC4895**, **APT44**, **TEMP.Armageddon**, **Turla**) in addition to broader criminal activity across multiple regions.
Jun 29, 2026
**Silver Dragon**, an emerging China-linked threat actor assessed as part of the **APT41** ecosystem, has conducted cyberespionage operations against **government entities in Europe and Southeast Asia** since at least mid-2024. Reporting based on Check Point research says the group gains initial access through a mix of **exploitation of public-facing servers** and **phishing emails with malicious attachments**, then blends into normal activity by **hijacking legitimate Windows services** for persistence and command-and-control (C2). The activity includes a toolchain that uses **heavily obfuscated loaders** (including **MonikerLoader** and **BamboLoader**) to decrypt and inject payloads in memory, with **Cobalt Strike** beacons commonly deployed as a final-stage payload. Check Point also observed **Google Drive-based C2** as an evasion technique, alongside Cobalt Strike configurations that can use **DNS tunneling**, **HTTP via Cloudflare**, or **SMB** for internal communications; additional custom post-exploitation tooling (e.g., screenshot capture utilities) was also reported, and artifacts suggested an **automated framework** for generating per-target attack packages (e.g., consistent file timestamps and recovered configuration logs with paths, service names, keys, and injected processes).
Jun 29, 2026