RANCOR

G0075CNEspionage0 reports from 0 vendors

The Rancor group’s attacks use two primary malware families which are naming DDKONG and PLAINTEE. DDKONG is used throughout the campaign and PLAINTEE appears to be new addition to these attackers’ toolkit. Countries Unit 42 has identified as targeted by Rancor with these malware families include, but are not limited to Singapore and Cambodia.

Vendor aliases (4)

The same group is tracked under different names by different vendors.

Vendor	Name
OSINT	Rancor group
OSINT	Rancor
OSINT	G0075
OSINT	Rancor Taurus

Targeting

Sectors: Government, Civil society

Victim countries: Singapore, Cambodia

MITRE ATT&CK techniques (9)

T1053.005 T1059.003 T1059.005 T1071.001 T1105 T1204.002 T1218.007 T1546.003 T1566.001

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names RANCOR, newest first. Open any report to see the full analysis with provenance.

No reports in the Lore library name this actor yet.

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to RANCOR. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (6)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

attack.mitre.orghttps://attack.mitre.org/groups/G0075
researchcenter.paloaltonetworks.comhttps://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/
cfr.orghttps://www.cfr.org/interactive/cyber-operations/rancor
attack.mitre.orghttps://attack.mitre.org/groups/G0075/
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/atoms/rancortaurus/