Malware
NIGHTFORGE
- First Reported
- Jun 10, 2026
- Latest Reported
- Jun 10, 2026
Reported Context (1)
- Both campaigns used a meeting-themed SFX archive to sideload a custom C++ loader we tracked as NIGHTFORGE, which decrypts and executes a Havoc Demon payload in memory. Khmer Shadow Campaigns Target Cambodian Government with NIGHTFORGE Loader and Havoc Demon
Malware (1)
People (3)
Threat Actors (1)
MITRE ATT&CK (7)
Products (2)
Tools (2)
Industries (3)
Countries (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.