Loading story…
Acronis Threat Research Unit reported that an espionage cluster dubbed Khmer Shadow targeted Cambodian government and public-sector entities, including the Information Collection Bureau under the Ministry of National Defense and the Ministry of Public Works and Transport. The attackers distributed meeting- and government-themed phishing archives containing a legitimate VMware-signed executable, such as VmwareSampling.exe or VMwareNamespaceCmd.exe, alongside a malicious vmtools.dll to trigger DLL sideloading and launch a custom C++ loader called NIGHTFORGE.
NIGHTFORGE decrypted and executed a Havoc Demon payload directly in memory while using NTDLL unhooking, Hell's Gate syscall resolution, and COM-based scheduled-task persistence to evade detection and maintain access. Researchers said the campaigns reused closely related tooling, payloads, and command-and-control infrastructure, including domains such as sharingfile[.]cloud and linkednewsapi[.]top, with traffic routed over ports 443 and 8443 through Cloudflare-fronted infrastructure and backend servers identified in Ukraine and the United States; Acronis linked the activity to a broader cluster it tracks as Amber Saolao and assessed the operations as espionage aligned with regional intelligence collection interests in Southeast Asia.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Cybersecurity News reported Acronis research on the same espionage activity and said Acronis attributed the related campaigns to a threat cluster it tracks as Amber Saolao. The report also highlighted phishing lures, scheduled-task persistence, and command-and-control infrastructure fronted through Cloudflare with backend servers in Ukraine and the United States.
Acronis Threat Research Unit identified two targeted espionage campaigns against Cambodian government entities, including the Information Collection Bureau under the Ministry of National Defense and the Ministry of Public Works and Transport. The campaigns used meeting-themed self-extracting archives to sideload the custom NIGHTFORGE loader via a legitimate VMware binary and a malicious DLL, ultimately executing a Havoc Demon payload in memory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourceacronis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research attributed a set of tightly scoped cyber-espionage campaigns against **government and law enforcement** organizations in Southeast Asia to a China-linked activity cluster it tracks as **Amaranth-Dragon**, assessed as connected to the broader **APT41** ecosystem. Targeting was reported across **Cambodia, Thailand, Laos, Indonesia, Singapore, and the Philippines**, with lures aligned to local geopolitical events and infrastructure configured for stealth, including **geofencing** so command-and-control only interacted with victims in specific countries. The intrusion chain evolved over 2025, and—shortly after public disclosure—began weaponizing the WinRAR vulnerability **CVE-2025-8088** via malicious RAR archives to achieve code execution and persistence. Reporting describes Amaranth-Dragon using a custom **Amaranth Loader** to deliver encrypted payloads, with C2 infrastructure shielded behind **Cloudflare** and use of legitimate services (e.g., *Dropbox*) to stage content; Check Point also documented deployment of the **Havoc C2 framework** and a newly tracked **TGAmaranth RAT** that uses **Telegram bot-based C2** and includes anti-EDR/anti-AV features. Separate coverage notes CVE-2025-8088’s exploitation mechanics (including abuse of Windows **Alternate Data Streams (ADS)** to write to arbitrary locations such as Startup paths) and that multiple other threat groups have also exploited the flaw, underscoring ongoing operational risk beyond this single actor.
Jun 29, 2026
A large-scale cyberespionage operation tracked as **TGR-STA-1030** (also **UNC6619**) has been reported compromising government and critical-infrastructure organizations across **37 countries**, with broader reconnaissance activity against government infrastructure in **155 countries**. The operation—described as “**Shadow Campaigns**”—uses **phishing** (often impersonating government entities) and **N-day vulnerability exploitation** across multiple enterprise and edge products (including **SAP**, **Microsoft Exchange**, and **D-Link**) to gain initial access, then deploys tooling for persistence, lateral movement, and stealth. Post-compromise activity includes deployment of **Diaoyu Loader** to stage frameworks and remote admin tooling such as **Cobalt Strike** and **VShell**, plus web shells and tunneling utilities. A notable capability is **ShadowGuard**, a **Linux eBPF rootkit** used for kernel-level stealth. Reporting also indicates Palo Alto Networks’ Unit 42 assessed the actor as **state-aligned and operating out of Asia**, citing indicators such as tooling, language preferences, activity patterns aligned to **GMT+8**, and infrastructure linkages; separate reporting claims Unit 42 initially connected the campaign more directly to **China** but softened public attribution due to concerns about potential retaliation following Chinese restrictions on certain foreign cybersecurity vendors’ software.
Jul 12, 2026
Positive Technologies reported that **PhantomCore** conducted a large-scale cyberespionage campaign using a mix of phishing, compromised corporate email accounts, malicious attachments and links, and in some cases exploitation of a TrueConf vulnerability chain tracked as `BDU:2025-10114`, `BDU:2025-10115`, and `BDU:2025-10116`. The group was observed deploying a substantial custom toolset including **PhantomRAT**, **PhantomRShell**, **PhantomTaskShell**, **PhantomProxyLite**, **PhantomStealer**, and a dedicated control panel, while also abusing legitimate software such as MeshAgent, OpenSSH, Rclone, and XenArmor. Researchers said the activity may indicate a split within the PhantomCore APT group. After gaining access, the attackers established persistence with disguised scheduled tasks, services, local accounts, and web shells, then stole credentials from **LSASS** and **NTDS**, moved laterally over **RDP**, **SMB**, and **WinRM**, and masked operations with obfuscated PowerShell, DLL hijacking, disabled defenses, and cleared logs. Their command-and-control infrastructure used phishing domains, VPS hosts, compromised servers, SSH and SOCKS5 tunnels, HTTPS, and nonstandard ports, with data exfiltration carried out through HTTP channels, external servers, and cloud storage including **Mega.nz**. In at least one intrusion, the operation escalated from espionage to destructive impact when PhantomCore used Kaspersky Security Center to distribute **LockBit 3.0** ransomware across compromised systems.
Jun 29, 2026