Rancor
MITRE ATT&CK: G0075 View on attack.mitre.org
Aliases: Rancor group, Rancor, Rancor Group, Rancor Taurus
- First seen
- 2017-12-01 00:00:00
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- Espionage
- Related IoCs
- 3 (3 malicious)
- Last IoC activity
- 2026-10-14 16:13:14
- Profile updated
- 2026-07-07 11:54:54
Targeted industries: government-and-public-sector media-and-entertainment
Targeted regions: country_code:id country_code:sg country_code:th country_code:my country_code:ph
Context
Rancor is a threat group that has led targeted campaigns against the South East Asia region. Rancor uses politically-motivated lures to entice victims to open malicious documents.
Recent IoC activity
3 malicious indicators in Maltiverse are attributed to Rancor (G0075). The 3 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | 235b238521e700517a2b4fcc4ba59f95cb7f1d8bdecf12373032d2bc79504028 | 2026-10-14 | 1 |
| file sample | 929be2bea7b0acf7a94cb4149dc09ff3e49534b9c8cddd083cd6f7bcd6770df1 | 2026-10-14 | 1 |
| file sample | 5bcf60dcd9e5a4578a280d6f4bf52356357e08a868f35d1697a836ebe01959fa | 2026-10-08 | 1 |
Detection coverage
- 4 YARA rules
- 248 Sigma rules
Malware & tools used
- Web Protocols (attack-pattern)
- Visual Basic (attack-pattern)
- Malicious File (attack-pattern)
- Scheduled Task (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Msiexec (attack-pattern)
- Windows Management Instrumentation Event Subscription (attack-pattern)
- Windows Command Shell (attack-pattern)
- Spearphishing Attachment (attack-pattern)
- certutil (malware)
- PLAINTEE (malware)
- Reg (malware)
- DDKONG (malware)
Reports & references
- researchcenter.paloaltonetworks.com — Unit42 Rancor Targeted Attacks South East Asia Using Plaintee Ddkong Malware Families (report)
- Palo Alto Unit 42 — Unit42 Rancor Targeted Attacks South East Asia Using Plaintee Ddkong Malware Families (report)
- cfr.org — Rancor (report)
- MITRE ATT&CK — G0075 (report)
- Palo Alto Unit 42 — Rancortaurus (report)