RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families
Summary: Unit 42 tracked highly targeted attacks across South East Asia in 2017 and 2018, attributed to a previously unidentified group it named RANCOR, using two malware families it calls DDKONG and PLAINTEE. The attacks began with spear-phishing decoys built from political news articles, hosted on legitimate sites including a Cambodian government website and Facebook, and the malware infrastructure split into two clusters, A and B, linked by their shared use of PLAINTEE.
Key Takeaway: PLAINTEE appears in only six samples in Unit 42's data set and is used exclusively by this group, so defenders have very little signature surface to work with. The decoys were served from a Cambodian government website that had already been compromised in an earlier KHRAT campaign and was likely compromised again in early 2018, which means trusted government domains were the delivery path.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026