RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families

### Executive summary: The report from Unit 42 documents a targeted espionage campaign named RANCOR operating in South East Asia that uses two primary malware families — DDKONG (TCP-based beaconing, plugin architecture) and PLAINTEE (custom XOR-encoded UDP protocol) — delivered via spear-phishing decoys, malicious Office macros, HTA and DLL loaders; it maps infrastructure into two clusters, provides behavior and persistence details, and lists extensive IoCs (hashes, domains, IPs, mutexes) and mitigation guidance.