Amaranth-Dragon
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:24:20
Targeted industries: government-and-public-sector technology-and-telecommunications healthcare-and-pharmaceutical
Targeted regions: country_code:kh country_code:th country_code:la country_code:id country_code:sg country_code:ph
Context
Amaranth-Dragon is a previously untracked threat actor assessed to be closely linked to the China-affiliated APT 41 ecosystem, exhibiting similar tooling and operational patterns. The group demonstrated technical maturity by rapidly operationalizing CVE-2025-8088, a vulnerability in WinRAR, shortly after its public disclosure. Check Point Research has identified multiple campaigns targeting Cambodia, Thailand, Laos, Indonesia, Singapore, and the Philippines, with operations typically focused on one or two countries at a time. The overlaps in technical and operational indicators strongly suggest that Amaranth-Dragon is either affiliated with or part of the broader APT-41 ecosystem.
Exploited vulnerabilities
- CVE-2025-8088 (vulnerability)
Reports & references
- blog.checkpoint.com — Amaranth Dragon Targeted Cyber Espionage Campaigns Across Southeast Asia (report)