DDKONG

MITRE ATT&CK: S0255 View on attack.mitre.org

Aliases: DDKONG

First seen
2017-02-01 00:00:00
Malware type
rat
Family
Malware family
Profile updated
2026-07-07 12:48:28

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:kh country_code:sg

Context

DDKONG is a malware sample that was part of a campaign by Rancor. DDKONG was first seen used in February 2017.

Detection coverage

  • 1 YARA rules
  • 133 Sigma rules

Malware & tools used

  • Ingress Tool Transfer (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Rundll32 (attack-pattern)
  • File and Directory Discovery (attack-pattern)

Used by threat actors

Detection rules

  • MALPEDIA_Win_Ddkong_Auto (yara-rule)

Reports & references

  • secureworks.com — Bronze Overbrook (report)
  • Palo Alto Unit 42 — Rancortaurus (report)
  • researchcenter.paloaltonetworks.com — Unit42 Rancor Targeted Attacks South East Asia Using Plaintee Ddkong Malware Families (report)
  • nao-sec.org — An Overhead View Of The Royal Road (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Ddkong (report)
  • Palo Alto Unit 42 — Rancor Cyber Espionage Group Uses New Custom Malware To Attack Southeast Asia (report)
  • MITRE ATT&CK — S0255 (report)

External references