Rancor (G0075) | Threat Actor Index

Techniques

Toolsets

CVEs Referenced

KEV Entries

About Rancor

Rancor is a threat group that has led targeted campaigns against the South East Asia region. Rancor uses politically-motivated lures to entice victims to open malicious documents.

View MITRE record ↗

Techniques by Tactic (9)

Initial Access

T1566.001 Spearphishing Attachment

Execution

T1053.005 Scheduled TaskT1059.003 Windows Command ShellT1059.005 Visual BasicT1204.002 Malicious File

Persistence

T1053.005 Scheduled TaskT1546.003 Windows Management Instrumentation Event Subscription

Privilege Escalation

T1053.005 Scheduled TaskT1546.003 Windows Management Instrumentation Event Subscription

Stealth

T1218.007 Msiexec

Command & Control

T1071.001 Web ProtocolsT1105 Ingress Tool Transfer

Toolsets (4)

🐛

DDKONG S0255

Malware

🐛

PLAINTEE S0254

Malware · Windows

🔧

Reg S0075

Tool · Windows

🔧

certutil S0160

Tool · Windows

References & Reports (1)

Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.

↑