Acronis TRU identified Khmer Shadow, a previously unreported cluster behind two espionage campaigns targeting Cambodian government entities in the defense, military intelligence, and public works sectors. The operation used SFX archives, vmtools.dll sideloading, NIGHTFORGE, KaynLdr, and Havoc Demon, while infrastructure overlaps pointed to C2 domains such as sharingfile[.]cloud and linkednewsapi[.]top. #KhmerShadow #NIGHTFORGE #HavocDemon #KaynLdr #sharingfilecloud #linkednewsapi-top
Keypoints
- Two targeted espionage campaigns were directed at Cambodian government entities, including the Information Collection Bureau, Ministry of Public Works and Transport, defense, and military intelligence sectors.
- The campaigns were attributed to a previously unreported cluster tracked as Khmer Shadow, with moderate confidence that the activity was espionage motivated.
- Delivery began with spear-phishing-style government-themed lures packaged as SFX archives, including a fake PDF executable disguised as a collaboration letter.
- The attackers used DLL sideloading through VMwareNamespaceCmd.exe and malicious vmtools.dll to run the custom loader NIGHTFORGE.
- NIGHTFORGE decrypted and executed a Havoc Demon payload in memory, used persistence via a scheduled task named VMwareNamespace, and employed stealth checks such as hiding windows and validating interactive sessions.
- The loader used advanced evasion techniques including NTDLL unhooking and Hell’s Gate syscall resolution, but also showed signs of ongoing development and operational shortcomings.
- C2 infrastructure centered on sharingfile[.]cloud and linkednewsapi[.]top, with CloudFlare protection and matching server characteristics suggesting shared operator control.
MITRE Techniques
- [T1566.001 ] Spearphishing Attachment – The campaign began with a suspected phishing email delivering a malicious archive disguised as a PDF attachment (‘suspected spear-phishing email delivering a compressed SFX archive’).
- [T1218.011 ] System Binary Proxy Execution: Rundll32/Related Signed Binary Sideloading – The attackers used VMwareNamespaceCmd.exe to load the malicious vmtools.dll through DLL sideloading (‘Windows automatically loads the malicious DLL before the application begins execution’).
- [T1574.002 ] Hijack Execution Flow: DLL Side-Loading – The legitimate VMware-signed binary loaded attacker-controlled vmtools.dll to execute NIGHTFORGE (‘sideloading vmtools.dll’).
- [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Not mentioned directly as a registry key, but persistence was established through an automatically running scheduled task; no registry-based autostart was described, so not applicable.
- [T1053.005 ] Scheduled Task/Job: Scheduled Task – Persistence was created by registering a scheduled task named VMwareNamespace (‘register the task under the name “VMwareNamespace”‘).
- [T1106 ] Native API – The loader used direct system calls and Windows APIs such as NtAllocateVirtualMemory, NtWriteVirtualMemory, and NtCreateThreadEx (‘using direct syscalls’).
- [T1027 ] Obfuscated Files or Information – The shellcode was stored encrypted and decrypted with XOR before execution (‘decrypts the encoded shellcode stored on disk’).
- [T1140 ] Deobfuscate/Decode Files or Information – NIGHTFORGE derived an XOR key from the first 8 bytes of the encrypted file and decrypted the payload (‘XORs them against a hardcoded magic value…to derive an 8-byte key’).
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – NTDLL unhooking removed inline hooks to bypass monitoring (‘used to remove the inline hooks’).
- [T1105 ] Ingress Tool Transfer – The payload was staged from disk and later executed in memory as part of the infection chain (‘decrypts and launches a Havoc Demon payload directly in memory’).
- [T1055.001 ] Process Injection: Dynamic-link Library Injection – The final stage injected code into memory and executed it within a process context (‘injecting it into the current process by allocating RWX memory’).
- [T1036 ] Masquerading – The lure files, task name, and process choices were designed to look legitimate (‘blends in with legitimate VMware entries’).
- [T1091 ] Replication Through Removable Media – Not mentioned in the article; no evidence provided, so not applicable.
- [T1202 ] Indirect Command Execution – The malicious DLL exported a function called by the signed binary to trigger execution (‘execution ultimately passes through VmCheck_IsVirtualWorld’).
- [T1112 ] Modify Registry – Not mentioned in the article; no registry modification was described, so not applicable.
Indicators of Compromise
- [File names ] Malicious SFX archives and payload-related files used for delivery – Contact_Letter_To_Ms_Pech_ICB_Cambodia_On_Collaboration.pdf.exe, CN_Contact_Work_Cambodia’s_Ministry_of_Public_Works_and_Transport.pdf
- [SHA256 hashes ] Identified archives and payloads uploaded for analysis – 1852120a84a328edd1995e633dfd2009867898a8e3f0b385e2490cf21c77a994, b3e853eee14fb7948c6907888ee07139085ba9af4231c30e97ff6236b86ca024, and 2 more hashes
- [SHA256 hashes ] Havoc payload samples extracted from the infection chain – 90bbfa9e7af176b85d110f4f1789cae6777fcb60813b047133c8f12caa344a17, 15278c52f4e0d8b5bbfe288a5e826ab2ebeaedb7fb85572940cf1263e384761f
- [File paths ] Persistence location used by the loader – %LOCALAPPDATA%VMwareNamespace
- [Scheduled task ] Persistence task created by NIGHTFORGE – VMwareNamespace, daily trigger starting 2010-01-01T00:00:00 with repeat every PT10M for P1D
- [Domains ] Command-and-control infrastructure observed in the Havoc config – sharingfile[.]cloud, linkednewsapi[.]top
- [IP addresses ] Origin servers behind the C2 infrastructure – 193[.]169[.]240[.]38, 104[.]193[.]255[.]99
- [Executable / DLL names ] Components used in the sideloading chain and reflective loading – VMwareNamespaceCmd.exe, vmtools.dll, KaynLdr