RANCOR Cyber Espionage Group Uncovered

guest · Jun 26, 2018

RANCOR Cyber Espionage Group Uncovered
June 26, 2018
https://www.securityweek.com/rancor-cyber-espionage-group-uncovered

The group, referred to as RANCOR, has been targeting political entities in Singapore, Cambodia, and Thailand, but might have hit targets in other countries as well. The group mainly uses two malware families, DDKONG and PLAINTEE, the latter apparently being a new addition to its arsenal.

The newly discovered campaign appears related to the KHRAT Trojan, a backdoor associated with the China-linked cyber espionage group known as DragonOK.

Only six samples of the malware were found, and the researchers managed to link them to two infrastructure clusters that do not appear to overlap. Both clusters, however, were involved in attacks targeting organizations in South East Asia, and the malware was observed using the same file paths in each cluster.
Click to expand...

guest · Oct 2, 2019

Chinese-linked hacking group gets crafty to avoid detection
October 2, 2019
https://www.cyberscoop.com/rancor-group-check-point-phishing-emails/

Over the last several months, Chinese-linked hackers have been targeting a Southeast Asian government using simple spearphishing emails and hundreds of malicious documents with a focus on consistently changing their tactics to avoid detection, according to Check Point research.
The most noteworthy part of the hackers’ months-long campaign is their perpetually changing tactics, according to Michael Abramzon, the cyber research team lead at Check Point.

The group, known as Rancor group, used different delivery methods and payloads in order to do so every couple of months.
Over time, the hackers also began installing a Chrome.js file to mimic a Google Chrome update to confuse victims into thinking files they clicked were normal. They have also dropped an Avast Antivirus executable to further disguise their activities.

They have “made it harder to connect the dots,” by “spoofing emails that look like other legitimate government organizations,” Abramzon said.
Click to expand...

guest · Oct 2, 2019

mood said: ↑

Chinese-linked hacking group gets crafty to avoid detection
October 2, 2019
https://www.cyberscoop.com/rancor-group-check-point-phishing-emails/
Click to expand...

Check Point: Rancor: The Year of The Phish

Rancor is a threat group active since at least 2017, and was previously observed carrying attacks Singapore and Cambodia, which are believed to be espionage motivated.

In this report, we will provide a deep dive analysis of the initial attack methods, infrastructure, and artifacts used against the targets in the latest campaign we discovered and attributed to this group. In addition, we will share some insights that might indicate the Rancor APT group is of a Chinese origin.
Conclusion
Rancor group, which was previously spotted attacking Cambodia and Singapore, continued its targeted attacks against entities within the East Asia region, this time concentrating 7 months of efforts on the East Asian government sector.
We expect the group to continue to evolve, constantly changing their TTPs in the same manner as we observed throughout the campaign, as well as pushing their efforts to bypass security products and avoid attribution.
Click to expand...

guest · Dec 17, 2019

Chinese Rancor APT Refreshes Malware Kit for Espionage Attacks
December 17, 2019
https://www.bleepingcomputer.com/ne...-refreshes-malware-kit-for-espionage-attacks/

A Chinese-linked hacking group deployed a new malware strain dubbed Dudell as part of attacks targeting Cambodian government organizations between December 2018 and January 2019.
The threat group tracked as Rancor by Palo Alto Networks' Unit 42 is known to have operated highly-targeted cyber-espionage campaigns against other targets from South East Asia, including but not limited to Cambodia and Singapore since at least 2017.
Custom malware used against government orgs
The DUDELL sample discovered by Unit 42 features similar malicious behavior to another malware sample connected to Rancor found by Check Point researchers while observing a campaign against several Southeast Asian government entities that span over seven months.

"The macro in this document gets executed when the user views the document and clicks Enable Content, at which point the macro locates and executes the data located under the Company field in the document’s properties," the researchers add.
Second stage malware payloads
As a second stage payload, the downloader will drop a DDKONG payload [...] can terminate processes on the compromised hosts, list folder contents, download and upload files, execute commands, take screenshots, and even act as a reverse shell to provide the attackers with remote access to the infected systems.
Click to expand...

Palo Alto Networks - Unit42: Rancor: Cyber Espionage Group Uses New Custom Malware to Attack Southeast Asia

Log in or Sign up

RANCOR Cyber Espionage Group Uncovered

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

RANCOR Cyber Espionage Group Uncovered

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches