khmer shadow

Executive Summary

Khmer Shadow is a China‑state-sponsored threat actor that employs spear‑phishing, credential theft and supply chain techniques to infiltrate government and commercial targets across Southeast Asia and beyond. Their attacks hinge on a custom NIGHTFORGE multi‑stage loader that deploys the Havoc Demon malware via in‑memory execution and sophisticated evasion (fiber shellcode, sandbox checks). While technically advanced, the group frequently reuses infrastructure, rendering their operations both detectable and traceable.

Goals & Targeting

The actor’s overarching objective appears to be espionage with secondary financial motives, focusing on extracting politically or commercially valuable information from government ministries, utilities, and key industry sectors in Southeast Asia. Their target list includes defense, public works, telecommunications, energy, healthcare, finance, and education—industries where compromise can yield strategic insights. Tactically, they employ spear‑phishing with tailored messaging (fake recruiters) to gain initial foothold, then expand privileges via credential theft or adversary‑in‑the‑middle techniques in Microsoft 365. They also exploit infrastructure vulnerabilities (CVE‑2026‑0257) and compromise legitimate cloud assets for C2 or web hosting, aligning with a pattern of blended exploitation—initial phishing followed by supply‑chain or authentication bypass escalation.

Key Capabilities

• Custom NIGHTFORGE/NightForge loader with multi‑stage infection chain
• In‑memory execution of Havoc Demon malware framework
• Precision spear‑phishing lures (fake recruiters, device code, Google Ads, procurement scams)
• Adversary‑in‑the‑middle credential theft on Microsoft 365
• Phishing via LNK file attachments and device codes
• Compromise/exploitation of attacker‑controlled infrastructure (domains, cloud resources, compromised sites)
• Command execution via PowerShell, Python, Bun, Git hooks
• Exploitation of PAN‑OS GlobalProtect Authentication Bypass CVE‑2026‑0257
• Triple‑layer encryption/decryption (modified RC4 → Base64 → SM4-CBC) and layered obfuscation
• Fiber‑based shellcode execution using CreateFiberEx / SwitchToFiber (sandbox/evasion)
• Sandbox detection against known analyst machine names
• Neutralization of security tooling before final payload deployment
• Machine‑specific filename for encrypted payload within legitimate staging directory
• Self‑extracting archives with DLL sideloading via VMwareNamespaceCmd.exe
• Persistence via COM‑based scheduled tasks

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Khmer Shadow’s known campaigns include a Cambodian government espionage operation using NIGHTFORGE and Havoc Demon, followed by an expanded attack vector that exploited the PAN‑OS GlobalProtect CVE‑2026‑0257 to compromise user identities across multiple countries. The actor demonstrates high technical sophistication (DLL sideloading, process injection, fiber shellcode, sandbox detection) but frequently reuses command‑and‑control infrastructure and payloads, making them readily identifiable when a single victim is discovered. Victim types span from defense ministries and public works agencies to telecoms, energy firms and universities, indicating a broad interest in strategic industrial sectors.

IOC Patterns

• Phishing email attachment with fake recruiter persona
• Malicious domain used for C2
• CVE‑2026‑0257 PAN‑OS GlobalProtect authentication bypass exploit
• Adversary‑in‑the‑middle targeting Microsoft 365
• Compromised cloud resource used for phishing/malware delivery
• Machine‑specific encrypted payload filename within staging directory
• Legitimate VMware‑signed binary used for DLL sideloading
• Self‑extracting archive containing DLL loader
• LNK file used in spearphishing delivery
• Fiber creation API usage (CreateFiberEx/SwitchToFiber) sandbox evasion checks

Recommended Actions

• Implement robust MFA across all corporate and Microsoft 365 accounts.
• Enforce email security controls (anti‑phishing filters, attachment sandboxing).
• Block known malicious domains and monitor for newly registered suspicious domains.
• Apply latest PAN‑OS updates to mitigate GlobalProtect authentication bypass vulnerability.
• Continuously monitor attacker‑controlled cloud infrastructure and compromised websites used for C2 or phishing.
• Detect custom fiber creation APIs such as CreateFiberEx / SwitchToFiber on endpoints.\nDetect and block self‑extracting archives that load DLL payloads.
• Deploy endpoint behavioral analysis rules to identify sandbox evasion signatures and neutralization of security tools.\nAdd signature rules for triple‑layer decryption patterns (modified RC4 → Base64 → SM4-CBC).
• Ensure scheduled task creation is monitored and validated for legitimacy.

Suggested Tags