Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Rancor: Cyber Espionage Group Uses New Custom Malware to Attack Southeast Asia

Summary: Unit 42 documented a cyber espionage group it named Rancor conducting targeted attacks in Southeast Asia throughout 2017 and 2018, including persistent targeting of at least one Cambodian government organization from December 2018 through January 2019. The group used an undocumented custom malware family named Dudell, a weaponized Excel document whose macro runs when a user clicks Enable Content, alongside the Derusbi backdoor and KHRat, with command-and-control at cswksfwq.kfesv[.]xyz and connect.bafunpda[.]xyz.

What's compelling: A single government organization in Cambodia absorbed repeated attack rounds across three months, and Rancor's toolset includes a VBScript that chains WMI event subscriptions to re-run its payload every five seconds - persistence that survives the usual cleanup.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related