- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- China
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2017–2026
- Status
- Active
- ATT&CK
- G0075 · 9 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0068 · rancor
ChinaWhat it is
Rancor is a threat group that has led targeted campaigns against the South East Asia region. Rancor uses politically-motivated lures to entice victims to open malicious documents.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0075
- Other names
- Rancor Group, Rancor Taurus
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Cambodia, Singapore, Vietnam
- Sectors
- Civil society, Government
Tools
The tools and malware families the sources tie to it.
- 8.t Dropper
- Cobalt Strike
- DDKONG
- DDKONG Plugin
- Derusbi
- Dudell
- ExDudell
- KHRAT
- KHRAT Trojan
- PLAINTEE
- Reg
- certutil
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de