Khmer Shadow Campaigns Target Cambodian Government with NIGHTFORGE Loader and Havoc Demon
Summary
Acronis details two espionage campaigns targeting Cambodian government entities. The Khmer Shadow cluster used SFX lures and a DLL-sideloaded NIGHTFORGE loader to deploy Havoc Demon, employing evasion techniques and reusing infrastructure.
Key points
- The campaigns targeted Cambodia’s Information Collection Bureau and Ministry of Public Works and Transport; Acronis assesses with moderate confidence that they were espionage-motivated.
- Suspected spear-phishing delivered meeting-themed self-extracting archives that sideloaded malicious vmtools.dll through a VMware-signed executable.
- NIGHTFORGE used NTDLL unhooking, Hell’s Gate syscall resolution, in-memory payload execution, and a recurring scheduled task for persistence.
- A KaynLdr reflective loader deployed the Havoc Demon implant, which communicated over HTTPS using browser-like traffic.
- Acronis linked two command-and-control domains and associated servers to the cluster through infrastructure analysis, while noting no confirmed attribution to a known actor.
- The campaigns reused payloads and infrastructure with little retooling; Acronis says its products detect and block the loader and payload.
Article Details
- Attack Vectors
- Suspected spear-phishing emails delivered government-themed, self-extracting archives masquerading as PDF documents.
- The archive's script executed VMwareNamespaceCmd.exe, which sideloaded the malicious vmtools.dll DLL.
- NIGHTFORGE decrypted shellcode and executed it in memory, leading to KaynLdr loading the Havoc Demon implant.
- NIGHTFORGE established persistence using a scheduled task named VMwareNamespace, configured to repeat every 10 minutes for one day.
- Defensive Notes
- Acronis reports detecting and blocking both NIGHTFORGE and the Havoc Demon payload as high-severity threats.
- Monitor for the VMwareNamespace scheduled task, the %LOCALAPPDATA%\VMwareNamespace\ persistence path, and the reported C2 indicators.
- The loader uses NTDLL unhooking, Hell's Gate syscall resolution, DLL sideloading, and in-memory payload execution to evade detection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | linkednewsapi[.]top | Domain assessed with moderate confidence as operated by the same threat cluster and identified as related C2 infrastructure. |
| DOMAIN | www[.]sharingfile[.]cloud | C2 domain configured in the Havoc Demon implant. |
| IPV4 | 104[.]193[.]255[.]99 | Server associated with linkednewsapi[.]top and assessed with moderate confidence as related threat-cluster infrastructure. |
| IPV4 | 193[.]169[.]240[.]38 | Origin IP identified with moderate confidence as the backend server for the sharingfile[.]cloud C2 domain. |
| SHA256 | 15278c52f4e0d8b5bbfe288a5e826ab2ebeaedb7fb85572940cf1263e384761f | SHA-256 hash listed for a Havoc payload. |
| SHA256 | 1852120a84a328edd1995e633dfd2009867898a8e3f0b385e2490cf21c77a994 | SHA-256 hash of the malicious Contact_Letter_To_Ms_Pech_ICB_Cambodia_On_Collaboration.pdf.exe SFX archive. |
| SHA256 | 90bbfa9e7af176b85d110f4f1789cae6777fcb60813b047133c8f12caa344a17 | SHA-256 hash listed for a Havoc payload. |
| SHA256 | b3e853eee14fb7948c6907888ee07139085ba9af4231c30e97ff6236b86ca024 | SHA-256 hash of the malicious CN_Contact_Work_Cambodia's_Ministry_of_Public_Works_and_Transport.pdf archive. |
MITRE ATT&CK
T1053.005 · Scheduled TaskNIGHTFORGE registers the VMwareNamespace persistence task through the Windows Task Scheduler service.T1055 · Process InjectionNIGHTFORGE allocates RWX memory, writes the decrypted shellcode, and creates a thread in the current process; Havoc Demon also uses gpupdate.exe as a sacrificial process for injection.T1070.004 · File DeletionThe archive's script deletes DLL files, the decoy PDF, the SFX archive, and other artifacts from disk.T1105 · Ingress Tool TransferThe report says NIGHTFORGE drops the Havoc Demon payload and retrieves and loads shellcode from a companion file.T1566.001 · Spearphishing AttachmentThe report describes a suspected spear-phishing email delivering the SFX archive.T1574.002 · DLL Side-LoadingThe malicious vmtools.dll is loaded by the legitimate VMwareNamespaceCmd.exe from the same archive directory.T1620 · Reflective Code LoadingKaynLdr loads the Havoc Demon implant entirely in memory without writing the decrypted payload to disk.
People
Chen MinglongName used by the purported sender of the decoy letter; the researchers could not find a public trace of the individual and suggest the persona may have been fabricated.Pech NgetNamed recipient of the decoy letter, described as appearing to work under Cambodia's Information Collection Bureau; the researchers could not find a public trace of the individual.Subhajeet SinghaAuthor of the Acronis Threat Research Unit article.
Threat Actors
Malware
Havoc DemonBoth campaigns used a meeting-themed SFX archive to sideload a custom C++ loader we tracked as NIGHTFORGE, which decrypts and executes a Havoc Demon payload in memory. NIGHTFORGEBoth campaigns used a meeting-themed SFX archive to sideload a custom C++ loader we tracked as NIGHTFORGE, which decrypts and executes a Havoc Demon payload in memory.
Products
Tools
Countries
Cambodiatargeting Cambodia's Information Collection Bureau (ICB) included a decoy PDF,Chinabilateral cooperation email between China and Cambodia, exactly the kind ofUkraineCloudFlare at 193.169.240[.]38, hosted by SERVER.UA LLC in Mykolayiv, Ukraine.United Statesunknown server at 104.193.255[.]99, hosted in Santa Clara, United States,
Industries
DefenseUnit (TRU) has identified two espionage-focused campaigns targeting Cambodian government entities in the defense and public works sectors. TRU has assessed with moderate confidence that the activity isGovernmentBehind Khmer Shadow: Targeted espionage against Cambodian government entitiesPublic works and transportwhile the campaign targeting the Ministry of Public Works and Transport did