Cambodia-focused cluster uses multistage infection chain with localized lures

MITRE Techniques

• [T1566 ] Phishing – The campaign used archive filenames and lure documents to entice victims (‘targeted-phishing delivery scenario’ and ‘Cambodian Government Notice on COVID-19 Prevention and Control’).
• [T1574.002 ] DLL Side-Loading – A signed Tencent binary loaded the malicious DLL (‘used to sideload the malicious DLL WfoY.qf’).
• [T1620 ] Reflective Code Loading – The final payload was reflectively loaded into memory (‘reflectively loads SparkRAT into a legitimate Windows process’).
• [T1055 ] Process Injection – The malware injected shellcode into vssvc.exe, ctfmon.exe, and svchost.exe (‘injects the decrypted shellcode into vssvc.exe’ and ‘injected into ctfmon.exe’).
• [T1562.001 ] Disable or Modify Tools – The loader impaired defenses by patching AMSI/ETW, adding exclusions, and weakening security processes (‘attempts to patch AMSI and ETW’ and ‘adding exclusions’).
• [T1027 ] Obfuscated Files or Information – Encrypted payloads were hidden in PNG files and decrypted at runtime (‘shellcode hidden in PNG files’ and ‘treats the concatenated IDAT data as the encrypted payload’).
• [T1068 ] Exploitation for Privilege Escalation – The campaign abused a vulnerable driver to gain privileged kernel capability (‘CVE-2026-36425’ and ‘permits local users to submit process-termination requests without adequate privilege validation’).
• [T1543.003 ] Windows Service – The malware created and started a service for persistence (‘sc create TaskHandler’ and ‘create a Windows Service’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – It also created an on-start scheduled task for persistence (‘schtasks /create /tn “TaskHandler”‘).
• [T1112 ] Modify Registry – Microsoft Defender exclusions were added through registry entries (‘configures Microsoft Defender exclusions by adding registry entries’).
• [T1134.001 ] Access Token Manipulation: Token Impersonation/Theft – The loader searched for winlogon.exe and impersonated its SYSTEM token (‘accesses winlogon.exe’s SYSTEM token for impersonation’).
• [T1083 ] File and Directory Discovery – The malware enumerated files, directories, and PNG components during staging (‘retrieves the directory and appends the following filename’).
• [T1518.001 ] Software Discovery: Security Software Discovery – It checked for Huorong and 360 security products before taking action (‘processes related to Huorong Internet Security’ and ‘360 Security processes’).
• [T1012 ] Query Registry – The payload added Defender exclusions and likely checked system configuration via registry-related actions (‘adding registry entries’).
• [T1003 ] OS Credential Dumping – Not observed directly; the campaign instead abused tokens and SYSTEM context, so no direct credential dumping was described in the article.
• [T1106 ] Native API – The malware used Windows APIs such as OpenProcessToken, NtCreateFile, NtReadFile, and TerminateProcess (‘OpenProcessToken’ and ‘TerminateProcess API’).
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – Timing-based anti-sandbox logic was used to detect analysis environments (‘timing-based anti-sandbox check’).
• [T1610 ] Deploy Container – Not observed; no container deployment was described in the article.