China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns
Summary: Check Point Research attributed a set of 2025 cyber espionage campaigns against government and law enforcement agencies in Cambodia, Thailand, Laos, Indonesia, Singapore, and the Philippines to a cluster it calls Amaranth-Dragon, which it links to the APT41 ecosystem. The campaigns abused CVE-2025-8088, a now-patched WinRAR arbitrary code execution flaw, roughly eight days after its public disclosure in August, delivering a malicious DLL called Amaranth Loader via DLL side-loading and, in a September 2025 Indonesia campaign, a RAT codenamed TGAmaranth RAT using a hard-coded Telegram bot for command and control.
Why it matters: The group operationalized a publicly disclosed WinRAR flaw in about eight days, and its command-and-control infrastructure was configured to accept traffic only from IP addresses inside the specific countries being targeted, which narrows the window for defenders to notice the activity at all.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-8088
- Related