Rancor

Overview

Rancor is a threat group that has led targeted campaigns against the South East Asia region. Rancor uses politically-motivated lures to entice victims to open malicious documents.

Naming & attribution

Rancor is tracked under 1 names across the industry. It uses 9 documented ATT&CK techniques — more than 26% of the 174 groups tracked here.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Machete — 6 shared techniques (43% overlap)
• Nomadic Octopus Russia — 4 shared techniques (33% overlap)
• Molerats — 6 shared techniques (32% overlap)
• Metador — 4 shared techniques (29% overlap)
• TA551 — 5 shared techniques (28% overlap)
• Confucius — 6 shared techniques (27% overlap)

Targets

Civil society · Government

Regions

Cambodia · Singapore

TTPs — 9 techniques across 5 tactics

Tools & malware (4)

Reg · DDKONG · PLAINTEE · certutil

Reporting (1)

• RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families — Ash, B., et al