Amaranth-Dragon

Executive Summary

Amaranth-Dragon is a high‑profile threat actor closely linked to the China‑affiliated APT41 ecosystem that rapidly weaponized the WinRAR CVE‑2025‑8088 and the TrueConf client zero‑day CVE‑2026‑3502, delivering malicious payloads via spearphishing attachments to government, financial and critical infrastructure targets in Southeast Asia. The group demonstrates sophisticated delivery, persistence, and cloud‑based infrastructure abuse, enabling persistent access across multiple platforms.

Goals & Targeting

The group’s primary objective is espionage and information gathering for state actors aligned with China. By targeting government ministries, defense entities, financial services, media, critical infrastructure, maritime, healthcare, IT, and energy sectors—most notably in Southeast Asia and the United States—they aim to acquire strategic, technical, and economic intelligence. Their use of disposable email accounts and cloud persistence indicates a focus on long‑term surveillance rather than short burst attacks.

Key Capabilities

• Weaponizes CVE‑2025‑8088 (WinRAR) via malicious RAR archives
• Exploits TrueConf client zero‑day CVE‑2026‑3502 through compromised update streams
• Uses spearphishing attachments to deliver malicious payloads
• Achieves persistence by dropping scripts/.bat files into Startup folders or registry run keys
• Creates disposable email accounts for targeted phishing campaigns
• Leverages free/trial services and cloud/container images (AWS AMI, GCP Image, Azure Image, Docker) for infrastructure and persistent access
• Employs obfuscated code, metamorphic techniques, and diverse malware families such as PlugX and WannaCry

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Amaranth‑Dragon’s campaigns exhibit an operational tempo of rapid weaponization and deployment—often launching new attacks within days of a CVE disclosure. Victims are predominantly state‑controlled entities in Southeast Asia, with occasional attacks on U.S. financial and defense sectors. The actor focuses on one or two countries simultaneously, maintaining localized spearphishing operations backed by disposable email accounts, while leveraging cloud images for persistence. Notable past operations include the use of backdoored WinRAR archives in late 2025 against Thai government ministries and the exploitation of TrueConf’s update mechanism to infiltrate Singaporean media firms.

IOC Patterns

• Malicious RAR archive filenames
• Exploitation of CVE‑2025‑8088 path traversal vulnerability
• Exploitation of CVE‑2026‑3502 TrueConf updater abuse
• .bat files placed in Startup folder for persistence
• Spearphishing email attachments containing malicious RAR
• Pattern of newly created disposable email accounts used for phishing campaigns
• Suspicious use of cloud/container image registries with backdoored images
• Use of free or trial services to set up infrastructure
• Domains pointing to malicious servers
• IP addresses used by command‑and‑control nodes
• URLs linking to payloads or download stagers
• SHA256 hash signatures for known malware binaries
• MD5 hash signatures for known malware binaries

Recommended Actions

• Apply emergency patches or workarounds for WinRAR CVE‑2025‑8088.
• Patch or disable automatic updates for TrueConf client until vulnerability is fixed.
• Block or filter suspicious RAR attachments in corporate email gateways.
• Educate users on spearphishing risks and safe attachment handling practices.
• Monitor and block malicious .bat scripts appearing in Startup folders.
• Implement least privilege and restrict software update channels.
• Deploy host‑based intrusion detection systems to spot known payloads.
• Implement advanced email filtering, anti‑phishing controls with safe link checks for inbound emails.
• Monitor organizational accounts for suspicious creation of new email or cloud service accounts and audit usage patterns.
• Deploy image scanning solutions for container registries to detect malicious modifications in AMI/GCP/Azure images and Docker containers.
• Patch all systems with the latest WinRAR updates promptly and disable legacy vulnerability features when possible.