RANCOR__2019__Rancor_Cyber_Espionage_Group_Uses_New_Custom_Malware_to_Attack_Southeast_Asia.pdf

Rancor, a cyber espionage group active since at least 2017, conducted targeted attacks in Southeast Asia using a weaponized Excel macro (Dudell) to download second-stage payloads and employing multiple backdoors and loaders (KHRAT, Derusbi), a DDKONG plugin, and an obfuscated VBScript that installs persistence via MOF/WMI; the Unit 42 report provides sample metadata, behavioral analysis, C2 domains/IPs, and SHA256 IoCs for detection and mitigation.