Loading story…
Recorded Future reported that APT32 launched a malware campaign targeting the Cambodian government. The activity was attributed to the Vietnam-linked threat group, also known as OceanLotus, and was described as part of a cyber-espionage effort aimed at government entities in Cambodia.
The operation used malware associated with APT32 to compromise targeted systems and collect intelligence, underscoring the group’s continued focus on regional political and governmental targets in Southeast Asia. The campaign added to prior reporting on APT32’s long-running use of tailored intrusion activity to support state-aligned espionage objectives.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Recorded Future published research describing a new malware campaign attributed to APT32 that targeted the Cambodian government. No additional event details or earlier milestones are provided in the reference content.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research attributed a set of tightly scoped cyber-espionage campaigns against **government and law enforcement** organizations in Southeast Asia to a China-linked activity cluster it tracks as **Amaranth-Dragon**, assessed as connected to the broader **APT41** ecosystem. Targeting was reported across **Cambodia, Thailand, Laos, Indonesia, Singapore, and the Philippines**, with lures aligned to local geopolitical events and infrastructure configured for stealth, including **geofencing** so command-and-control only interacted with victims in specific countries. The intrusion chain evolved over 2025, and—shortly after public disclosure—began weaponizing the WinRAR vulnerability **CVE-2025-8088** via malicious RAR archives to achieve code execution and persistence. Reporting describes Amaranth-Dragon using a custom **Amaranth Loader** to deliver encrypted payloads, with C2 infrastructure shielded behind **Cloudflare** and use of legitimate services (e.g., *Dropbox*) to stage content; Check Point also documented deployment of the **Havoc C2 framework** and a newly tracked **TGAmaranth RAT** that uses **Telegram bot-based C2** and includes anti-EDR/anti-AV features. Separate coverage notes CVE-2025-8088’s exploitation mechanics (including abuse of Windows **Alternate Data Streams (ADS)** to write to arbitrary locations such as Startup paths) and that multiple other threat groups have also exploited the flaw, underscoring ongoing operational risk beyond this single actor.
Jun 29, 2026
Amnesty International reported that Vietnamese human rights defenders and a rights organization were targeted in a coordinated spyware campaign attributed to **Ocean Lotus** (`APT32`) between 2018 and 2020. Identified victims included blogger and activist **Bui Thanh Hieu**, the nonprofit **VOICE** (Vietnamese Overseas Initiative for Conscience Empowerment), and another Vietnam-based blogger whose identity was withheld for safety reasons. The operation used phishing emails carrying malicious attachments or links, then delivered malware for **macOS** and **Windows** while displaying decoy documents to disguise the intrusion. On Windows systems, the attackers deployed **Kerrdown** and then **Cobalt Strike** to expand access and control over compromised devices. The activity fits a broader pattern of reporting on Ocean Lotus operations targeting Vietnamese civil society, media, and other entities, with multiple investigations describing the group as aligned with Vietnamese state interests, although Amnesty said it could not independently prove a direct link to the Vietnamese government. Amnesty said the surveillance campaign formed part of a wider environment of repression, censorship, arrests, harassment, and online restrictions affecting activists in Vietnam, and called for an independent investigation and tighter controls on surveillance technology.
Jun 29, 2026
Acronis Threat Research Unit reported that an espionage cluster dubbed **Khmer Shadow** targeted Cambodian government and public-sector entities, including the Information Collection Bureau under the Ministry of National Defense and the Ministry of Public Works and Transport. The attackers distributed meeting- and government-themed phishing archives containing a legitimate VMware-signed executable, such as `VmwareSampling.exe` or `VMwareNamespaceCmd.exe`, alongside a malicious `vmtools.dll` to trigger DLL sideloading and launch a custom C++ loader called **NIGHTFORGE**. NIGHTFORGE decrypted and executed a **Havoc Demon** payload directly in memory while using **NTDLL unhooking**, **Hell's Gate** syscall resolution, and **COM-based scheduled-task persistence** to evade detection and maintain access. Researchers said the campaigns reused closely related tooling, payloads, and command-and-control infrastructure, including domains such as `sharingfile[.]cloud` and `linkednewsapi[.]top`, with traffic routed over ports `443` and `8443` through Cloudflare-fronted infrastructure and backend servers identified in Ukraine and the United States; Acronis linked the activity to a broader cluster it tracks as **Amber Saolao** and assessed the operations as espionage aligned with regional intelligence collection interests in Southeast Asia.
Jun 29, 2026