RANCOR__2019__RANCOR_APT_Suspected_targeted_attacks_against_South_East_Asia.pdf

This report details suspected Rancor APT activity targeting Southeast Asian (Cambodian) government entities via malicious RTF documents that exploit CVE-2018-0798 to drop a temporary payload which downloads a second-stage backdoor (likely DDKONG or PLAINTEE). The analysis outlines the exploitation chain, persistence mechanisms (scheduled tasks, certutil usage, VBScript), and provides IoCs including MD5 hashes and an IP used to serve the payload.