File · RANCOR · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 9 techniques across 5 tactics
Analyst brief
misp-galaxy + mitre-attackThe Rancor group’s attacks use two primary malware families which are naming DDKONG and PLAINTEE. DDKONG is used throughout the campaign and PLAINTEE appears to be new addition to these attackers’ toolkit. Countries Unit 42 has identified as targeted by Rancor with these malware families include, but are not limited to Singapore and Cambodia.
Observed targets (as stated by the sources)
2 countries · 2 sectorsassessed origin · Chinaobserved targets · 2
countries · 2
- Singapore
- Cambodia
sectors · 2
- Government
- Civil society
as stated by MISP galaxy / ransomware.live — not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique9 techniques · 5 of 15 tactics
Initial access
1 techniqueExecution
4 techniquesPrivilege escalation
1 techniqueStealth
1 techniqueCommand and control
2 techniques
select a technique
Arsenal
2 malware · 2 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Take it with you
keyless · no signupReferences
6 sources- 1.unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-p…
- 2.cfr.org/interactive/cyber-operations/rancor
- 3.attack.mitre.org/groups/G0075
- 4.unit42.paloaltonetworks.com/atoms/rancortaurus
- 5.attack.mitre.org/groups/G0075
- 6.researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia…
Track RANCOR on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.