RANCOR first emerged in February 2017 as a state-sponsored cyber espionage group, primarily targeting entities within Southeast Asia for intelligence gathering and covert operations. The group, which is assessed with high confidence to be of Chinese origin, is known by various aliases including G0075, Rancor Taurus, and Rancor group. While its activities might sometimes be observed in contexts similar to groups like APT32 or Mustang Panda, RANCOR maintains a distinct operational methodology. The group distinguishes itself through its consistent use of custom backdoors such as DDKONG and PLAINTEE, coupled with advanced social engineering tactics and custom exploit delivery for persistent access. RANCOR demonstrates an ongoing evolution in its operational approach, continually refining its malware to enhance stealth and persistence on compromised systems, and increasingly leveraging zero-day vulnerabilities in its campaigns to achieve long-term data exfiltration and intelligence objectiv

Aliases del actor

G0075Rancor TaurusRancor groupAPT RANCORDragon CastlingG0017CVE-2015-1641otras referencias asociadas a vulnerabilidadesamenazas de ciberseguridadKHRAT TrojanDurusbiDudellDDKONG PluginSouth-East AsiaDragonOKhttps

Actores similares

apt-rancoractor · 1apt-dragonokactor · 1Operation Dragon Castlingapt · 0apt-camarodragonactor · 1apt-equationgroupactor · 1apt-group5actor · 1apt-middleeastactor · 1Aoqin Dragonapt · 1Night Dragonapt · 1Amaranth-Dragonapt · 0