{ "id": "c3480841-ae4a-4726-8a3b-5b09586aa859", "created_at": "2026-04-06T00:14:23.678359Z", "updated_at": "2026-04-10T13:12:48.618962Z", "deleted_at": null, "sha1_hash": "7f1e6716c60c895ab43fd8698d4a953b721980fb", "title": "Threat Group Cards: A Threat Actor Encyclopedia", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 54513, "plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 18:59:29 UTC\n APT group: Rancor\nNames\nRancor (Palo Alto)\nRancor Group (Palo Alto)\nRancor Taurus (Palo Alto)\nG0075 (MITRE)\nCountry China\nMotivation Information theft and espionage\nFirst seen 2017\nDescription\n(Palo Alto) Throughout 2017 and 2018 Unit 42 has been tracking and observing a series\nof highly targeted attacks focused in South East Asia, building on our research into the\nKHRAT Trojan. Based on the evidence, these attacks appear to be conducted by the\nsame set of attackers using previously unknown malware families. In addition, these\nattacks appear to be highly targeted in their distribution of the malware used, as well as\nthe targets chosen. Based on these factors, Unit 42 believes the attackers behind these\nattacks are conducting their campaigns for espionage purposes.\nWe believe this group is previously unidentified and therefore have we have dubbed it\n“Rancor”. The Rancor group’s attacks use two primary malware families which we\ndescribe in depth later in this blog and are naming DDKONG and PLAINTEE.\nDDKONG is used throughout the campaign and PLAINTEE appears to be new addition\nto these attackers’ toolkit.\nKaspersky found connections between this group and DragonOK.\nObserved\nSectors: Government and political entities.\nCountries: Cambodia, Singapore, Vietnam and Southeast Asia.\nTools used\n8.t Dropper, certutil, Cobalt Strike, DDKONG, Derusbi, Dudell, ExDudell, KHRAT,\nPLAINTEE.\nInformation https://apt.etda.or.th/cgi-bin/showcard.cgi?u=020d538c-5250-46d8-9713-e739536cdd7e\nPage 1 of 2\n\nMITRE ATT\u0026CK Playbook Last change to this card: 16 August 2025\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=020d538c-5250-46d8-9713-e739536cdd7e\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=020d538c-5250-46d8-9713-e739536cdd7e\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://apt.etda.or.th/cgi-bin/showcard.cgi?u=020d538c-5250-46d8-9713-e739536cdd7e" ], "report_names": [ "showcard.cgi?u=020d538c-5250-46d8-9713-e739536cdd7e" ], "threat_actors": [ { "id": "5ffe400c-6025-44c2-9aa1-7c34a7a192b0", "created_at": "2023-01-06T13:46:38.469688Z", "updated_at": "2026-04-10T02:00:02.987949Z", "deleted_at": null, "main_name": "DragonOK", "aliases": [ "Moafee", "BRONZE OVERBROOK", "G0017", "G0002", "Shallow Taurus" ], "source_name": "MISPGALAXY:DragonOK", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "7ebda3c6-1789-4d84-97cf-47fb18a0cb28", "created_at": "2022-10-25T15:50:23.78829Z", "updated_at": "2026-04-10T02:00:05.415039Z", "deleted_at": null, "main_name": "DragonOK", "aliases": [ "DragonOK" ], "source_name": "MITRE:DragonOK", "tools": [ "PoisonIvy", "PlugX" ], "source_id": "MITRE", "reports": null }, { "id": "e8aee970-e31e-489f-81c2-c23cd52e255c", "created_at": "2023-01-06T13:46:38.763687Z", "updated_at": "2026-04-10T02:00:03.092181Z", "deleted_at": null, "main_name": "RANCOR", "aliases": [ "Rancor Group", "G0075", "Rancor Taurus", "Rancor group", "Rancor" ], "source_name": "MISPGALAXY:RANCOR", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "6d11e45c-4e31-4997-88f5-295b2564cfc6", "created_at": "2022-10-25T15:50:23.794721Z", "updated_at": "2026-04-10T02:00:05.358892Z", "deleted_at": null, "main_name": "Rancor", "aliases": [ "Rancor" ], "source_name": "MITRE:Rancor", "tools": [ "DDKONG", "PLAINTEE", "certutil" ], "source_id": "MITRE", "reports": null }, { "id": "593dd07d-853c-46cd-8117-e24061034bbf", "created_at": "2025-08-07T02:03:24.648074Z", "updated_at": "2026-04-10T02:00:03.625859Z", "deleted_at": null, "main_name": "BRONZE OVERBROOK", "aliases": [ "Danti ", "DragonOK ", "Samurai Panda ", "Shallow Taurus ", "Temp.DragonOK " ], "source_name": "Secureworks:BRONZE OVERBROOK", "tools": [ "Aveo", "DDKONG", "Godzilla Webshell", "HelloBridge", "IsSpace", "NFLog Trojan", "PLAINTEE", "PlugX", "Rambo" ], "source_id": "Secureworks", "reports": null }, { "id": "340d1673-0678-4e1f-8b75-30da2f65cc80", "created_at": "2022-10-25T16:07:23.552036Z", "updated_at": "2026-04-10T02:00:04.653109Z", "deleted_at": null, "main_name": "DragonOK", "aliases": [ "Bronze Overbrook", "G0017", "Shallow Taurus" ], "source_name": "ETDA:DragonOK", "tools": [ "Agent.dhwf", "CT", "Chymine", "Darkmoon", "Destroy RAT", "DestroyRAT", "FF-RAT", "FormerFirstRAT", "Gen:Trojan.Heur.PT", "HTran", "HUC Packet Transmit Tool", "HelloBridge", "IsSpace", "KHRAT", "Kaba", "Korplug", "Mongall", "NFlog", "NewCT", "NfLog RAT", "PlugX", "Poison Ivy", "Rambo", "RedDelta", "SPIVY", "Sogu", "SysGet", "TIGERPLUG", "TVT", "Thoper", "TidePool", "Xamtrav", "brebsd", "ffrat", "pivy", "poisonivy" ], "source_id": "ETDA", "reports": null }, { "id": "416f8374-2b06-47e4-ba91-929b3f85d9bf", "created_at": "2022-10-25T16:07:24.093951Z", "updated_at": "2026-04-10T02:00:04.864244Z", "deleted_at": null, "main_name": "Rancor", "aliases": [ "G0075", "Rancor Group", "Rancor Taurus" ], "source_name": "ETDA:Rancor", "tools": [ "8.t Dropper", "8.t RTF exploit builder", "8t_dropper", "Agentemis", "Cobalt Strike", "CobaltStrike", "DDKONG", "Derusbi", "Dudell", "ExDudell", "KHRAT", "PLAINTEE", "RoyalRoad", "certutil", "certutil.exe", "cobeacon" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434463, "ts_updated_at": 1775826768, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/7f1e6716c60c895ab43fd8698d4a953b721980fb.pdf", "text": "https://archive.orkl.eu/7f1e6716c60c895ab43fd8698d4a953b721980fb.txt", "img": "https://archive.orkl.eu/7f1e6716c60c895ab43fd8698d4a953b721980fb.jpg" } }