Sun Orcal Adds GitHub and Steganography to its Repertoire, Expands to Vietnam and Myanmar
Summary: Unit 42 found a new SunOrcal variant, in the wild since at least May 2017, that pulls command-and-control host and port data from files in a GitHub repository named NordicMyth and hides a DLL inside a downloaded bitmap file. The same steganography appeared in a malicious RTF document served November 8, 2017 with a Vietnamese-language lure about Donald Trump, APEC and the South China Sea, and SunOrcal activity in March and May 2016 targeted at least one official entity in Myanmar, both outside the group's usual targeting.
What's compelling: The attackers moved from their documented focus on the "Five Poisons" to Vietnam and Myanmar, and they now beacon to a legitimate site like GitHub to fetch C2 details, so blocking known-bad domains alone will not surface the traffic.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026