Loading threat actor…
Amaranth-Dragon is a China-linked cyber-espionage threat cluster active throughout 2025 and assessed as closely linked to the APT41 ecosystem. The group has conducted highly targeted operations against government and law enforcement organizations across Southeast Asia, with campaigns aligned to local political and geopolitical events and focused on long-term intelligence collection rather than disruption. Reported overlaps with APT41 include similarities between the actor’s custom tooling and APT41-associated malware families such as DodgeBox, Dustpan, and Dusttrap, as well as shared tradecraft including DLL sideloading and operational patterns consistent with UTC+8 working hours. Amaranth-Dragon rapidly weaponized newly disclosed vulnerabilities, most notably CVE-2025-8088 in WinRAR, incorporating exploitation within days of public disclosure. Its delivery chains have used spear-phishing-style lures and politically themed archive files hosted on legitimate cloud services, including password-protected archives. Earlier campaigns used ZIP archives containing shortcut and batch-script components, while later activity used malicious RAR archives to achieve code execution and persistence. Post-exploitation commonly involved a custom component known as Amaranth Loader, which retrieved encrypted payloads, decrypted them with externally obtained keys, and executed them in memory. The actor primarily deployed the Havoc command-and-control framework as a final payload. The group has also used a Telegram-controlled malware family known as TGAmaranth RAT, particularly in Indonesia-focused operations. TGAmaranth RAT supports remote command execution, process listing, screenshot capture, and file transfer, and has been reported to include anti-debugging and anti-EDR or anti-AV measures. Across campaigns, Amaranth-Dragon has demonstrated disciplined operational security by fronting infrastructure with Cloudflare and restricting command-and-control access to IP space in intended victim countries, reducing exposure and collateral detection. Known aliases and related designations include Amaranth Dragon and Amaranth-Dragon. The actor is best understood as a Chinese-aligned espionage operator or sub-cluster within, or closely affiliated with, the broader APT41 ecosystem.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Attack chains mounted by the adversary have been found to abuse CVE-2025-8088, a now-patched security flaw impacting RARLAB WinRAR that allows for arbitrary code execution when specially crafted archives are opened by targets. The exploitation of the vulnerability was observed about eight days after its public disclosure in August.
A high-severity security flaw in the TrueConf client video conferencing software has been exploited in the wild as a zero-day as part of a campaign targeting government entities in Southeast Asia dubbed TrueChaos. The vulnerability in question is CVE-2026-3502 (CVSS score: 7.8), a lack of integrity check when fetching application update code, allowing an attacker to distribute a tampered update, resulting in the execution of arbitrary code.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Attributed with using the Havoc framework in intrusions targeting government and law enforcement agencies across Southeast Asia.
Referenced as a Chinese-nexus threat actor previously documented abusing the Havoc framework in real-world intrusions.
China-linked espionage activity cluster targeting government and law enforcement in Southeast Asia; linked to the APT41 ecosystem.
Referenced as conducting targeted espionage in Southeast Asia and weaponizing CVE-2025-8088. No further operational details are provided in this excerpt.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.