Loading story…
The cyber-espionage group Rancor was reported using new custom malware to target organizations in Southeast Asia, expanding a long-running intrusion set focused on regional victims. The activity was attributed to espionage operations rather than financially motivated crime, with attackers relying on tailored malware and campaign-specific tooling to gain access and maintain a foothold in targeted environments.
The reporting indicates that Rancor continued to refine its tradecraft by introducing previously unseen malware in attacks against entities in the region, underscoring the group’s persistence and operational development. For defenders, the activity highlights the ongoing risk from state-aligned or espionage-focused actors that adapt malware families and intrusion methods to sustain access to government and other strategically relevant targets in Southeast Asia.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published research describing the cyber-espionage group Rancor using new custom malware to target organizations in Southeast Asia. The report publicly documented the campaign and its tooling.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Rancor** threat group conducted a sustained espionage campaign against government entities in Southeast Asia, using spear-phishing emails that impersonated officials and carried politically themed decoy documents. Researchers tied the activity to operations spanning late 2018 through mid-2019, with attackers exploiting Microsoft Equation Editor flaws including **`CVE-2018-0798`** and using malicious macros to gain initial access. Reporting also linked the campaign to earlier Rancor intrusions in the region involving the **PLAINTEE** and **DDKONG** malware families. The operation evolved across multiple clusters, shifting from macro-delivered **VBScript** and **PowerShell** payloads to more advanced tradecraft such as **DLL side-loading** with legitimate antivirus executables and, in at least one case, **Cobalt Strike Beacon**. Attribution to Rancor was supported by overlapping infrastructure, loaders, metadata, persistence methods, and known command-and-control indicators, while separate research noted that multiple Chinese threat groups were exploiting the same Equation Editor vulnerability during the same period; Check Point assessed this campaign may be of **Chinese origin** based on language artifacts, operator working hours, use of the **8.t** exploit builder, and an operational pause during Lunar New Year.
Aug 14, 2026
The **SideWinder** espionage group, also tracked as **RagaSerpent** and suspected to be India-linked, has expanded targeted operations across Southeast Asia, including **Thailand** and **Indonesia**, with victims spanning government, telecommunications, critical infrastructure, maritime, logistics, and nuclear-sector organizations. Reporting indicates the campaign remains focused on intelligence collection and long-term access rather than disruption, with operators using spear-phishing, stolen credentials, older Microsoft Office vulnerabilities, and DLL hijacking to gain entry into victim environments. Researchers said the group offsets these relatively simple intrusion methods with disciplined post-compromise tradecraft, including staged payload delivery, persistence through Windows services, and rapidly rotating command-and-control infrastructure. A notable feature of recent activity is malware that derives its C2 configuration dynamically at runtime, allowing operators to shift infrastructure without rebuilding payloads and complicating remediation. Separate reporting also links **RagaSerpent** to a multi-country targeted intrusion chain described as a SideWinder-adjacent **"Tax Audit"** cluster, reinforcing concerns that the threat actor is sustaining broad regional espionage activity and pre-positioning inside networks for strategic access.
Jun 29, 2026
Check Point Research attributed a set of tightly scoped cyber-espionage campaigns against **government and law enforcement** organizations in Southeast Asia to a China-linked activity cluster it tracks as **Amaranth-Dragon**, assessed as connected to the broader **APT41** ecosystem. Targeting was reported across **Cambodia, Thailand, Laos, Indonesia, Singapore, and the Philippines**, with lures aligned to local geopolitical events and infrastructure configured for stealth, including **geofencing** so command-and-control only interacted with victims in specific countries. The intrusion chain evolved over 2025, and—shortly after public disclosure—began weaponizing the WinRAR vulnerability **CVE-2025-8088** via malicious RAR archives to achieve code execution and persistence. Reporting describes Amaranth-Dragon using a custom **Amaranth Loader** to deliver encrypted payloads, with C2 infrastructure shielded behind **Cloudflare** and use of legitimate services (e.g., *Dropbox*) to stage content; Check Point also documented deployment of the **Havoc C2 framework** and a newly tracked **TGAmaranth RAT** that uses **Telegram bot-based C2** and includes anti-EDR/anti-AV features. Separate coverage notes CVE-2025-8088’s exploitation mechanics (including abuse of Windows **Alternate Data Streams (ADS)** to write to arbitrary locations such as Startup paths) and that multiple other threat groups have also exploited the flaw, underscoring ongoing operational risk beyond this single actor.
Jun 29, 2026