This China-linked espionage group keeps trying to hack the Cambodian government

Rancor has tried to break into the network of an unnamed Cambodian government organization and deploy their custom malware.

There is no shortage of malware that government-backed hackers can get from the public domain, saving them the trouble of developing their own code. But to meet their intelligence-gathering needs, plenty of groups still roll up their sleeves and build their own kits.

A Chinese espionage outfit known as Rancor has been particularly active on that front. New findings from Palo Alto Networks’ Unit 42 research unit, shared exclusively with CyberScoop, show how, over the past year, the group has tried to break into the network of an unnamed Cambodian government organization and deploy their custom malware.

First, the group laced a Microsoft Excel document with previously undocumented malware in an attempted breach of the Cambodian organization in December 2018 and January 2019, Unit 42 said. When that didn’t work, Rancor packed a computer script with a bunch of potentially infectious code, Unit 42 researchers discovered in July.

The research shows the lengths to which well-resourced groups will go to develop their own hacking tools. Since Rancor’s emergence in 2017, “the only tools we’ve seen them use are all custom” — either unique to Rancor or to a small cluster of Chinese espionage groups, said Jen Miller-Osborn, Unit 42’s deputy director of threat intelligence.

“They have whatever their target list is and, if they aren’t currently in them, they have spent the entire year trying to ensure that they have access to these organizations,” Miller-Osborn told CyberScoop.

The prolific malware development is consistent with a group that is dead-set on getting into their target networks. But ironically, Unit 42 said, none of the attacks on the Cambodian government organization appear to have been successful; the target has blocked the malware at each turn.

Miller-Osborn declined to name the Cambodian government organization, but did say it “is exactly who you would expect an espionage-based group to target.” And given Rancor’s persistence to date, she expects the group to continue to try to breach the Cambodian organization.

Other researchers have taken note of Rancor’s activity in Southeast Asia, which has also included hacking attempts in Singapore. In October, cybersecurity company Check Point said that the group had targeted five unnamed government agencies in the region.

The Chinese government has looked to project its military and economic power throughout Southeast Asia, often clashing with U.S. interests. In Cambodia, the Chinese military has reportedly struck an agreement to use a naval base, while Chinese companies have invested billions of dollars in the country.

With those interests at stake, any number of Cambodian government organizations could make an attractive target for Chinese hackers. Ahead of the July 2018 general election in Cambodia, China-linked hackers breached the networks of the opposition political party.

“It’s not surprising that China is covering all of its bases and wanting to understand what’s happening inside Cambodia, inside government ministries [there],” said Brian Harding, deputy director of the Southeast Asia Program at the Center for Strategic and International Studies.

The Chinese government has been trying to use Cambodia to drive a wedge in the Association of Southeast Asian Nations, a bloc that deals with regional security issues, Harding said. “The China-Cambodia relationship is particularly important for China.”

A spokesperson at the Chinese Embassy in Washington, D.C., did not respond to a request for comment on the new research.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure