China-linked Amaranth-Dragon Uses WinRAR Flaw for Southeast Asia Espionage
Chinese-linked Amaranth-Dragon has run tightly targeted cyber-espionage campaigns against Southeast Asian government and law-enforcement agencies in 2025, exploiting the WinRAR CVE-2025-8088 flaw via spear-phishing archives hosted on cloud platforms to deploy Amaranth Loader and the Havoc C2 framework; the activity shows APT41 ties, with country-specific infrastructure and anti-analysis techniques, and is complemented by a separate Mustang Panda PlugX Diplomacy operation using LOLBins and staged with diplomatic/election-themed lures.
