Acronis Theat Research Unit (TRU) has identified two campaigns of espionage against Cambodian government agencies conducted by a cluster tracked as Khmer Shadow
10Acronis, global leader in the protection informatica announces that it has identified two espionage campaigns against Cambodian government entities in the defense and public works sectors. Both campaigns, detected by the Acronis Theat Research Unit (TRU), distributed a previously undocumented DLL-based loader, tracked as NIGHTFORGE, via government-themed lures packaged in self-extracting archives (SFX). Once executed, NIGHTFORGE decrypted itself and booted a Havoc Demon payload directly into memory. The two campaigns shared nearly identical tooling and infrastructure, with minimal changes between targets, suggesting a slow pace of retooling by the operator.
Based on targeting patterns, decoy construction, and infrastructure characteristics, TRU assesses with moderate confidence that the activity is motivated by espionage and likely aligned with regional intelligence gathering interests in Southeast Asia. Acronis TRU is tracking the previously unreported cluster as Khmer Shadow.
The attack chain
The attack chain began with a suspected spear-phishing email that delivered a compressed SFX archive. The archive contained multiple benign library files along with a malicious DLL used for sideloading. At this point NIGHTFORGE has established persistence, deposited the Havoc Demon payload, and connected to the command and control server. The main difference between the two campaigns was the decoy document. The campaign targeting Cambodia's Information Collection Bureau (ICB) included a decoy PDF, while the campaign against the Ministry of Public Works and Transport did not. Upon analyzing the decoy document, it was discovered that the letter was addressed to Ms. Pech Nget, apparently employed by the Information Collection Bureau (ICB) of the Ministry of National Defense of Cambodia. The sender signed himself Chen Minglong of a “Development and Investment Division” based in Beijing. No public traces of either individual were found, suggesting that the operator may have fabricated both identities to lend credibility to the bait.
The content of the letter spoke of an upcoming “mission in May 2026” and outlined three proposed areas of coordination: defining a data exchange protocol between the sender's division and the ICB, discussing what technical resources the ICB team can provide, and organizing authorizations and meetings for a site visit with MOD personnel. The text appeared to be a standard bilateral cooperation email between China and Cambodia, exactly the kind of communication that anyone engaged in defense coordination would open without a second thought. In particular, the letter mentioned an individual called Youthy and an “EOD Administrative team”. While it was not possible to verify the two references, their inclusion suggests that the operator attempted to incorporate organization-specific details into the bait to increase its credibility.
Attribution and confidence level
In threat intelligence, attribution is never easy. Threat groups regularly borrow, share, and copy tools and techniques from each other, and a TTP match alone is rarely enough to attribute an operation to a specific actor. With this in mind, TRU approached the campaign with caution, considering the whole picture rather than the individual artifact.
The use of vmtools.dll as a sideloaded DLL deserves specific mention because the technique has been observed before, most notably with APT29 in a campaign against European diplomats in early 2025 and in the case of groups like Mustang Panda and PatchWork. The file name is a natural choice for abusers of VMware-signed binaries, as vmtools.dll is distributed with VMware Tools and appears on HijackLibs as a known target for sideloading. Overlap, therefore, cannot be treated as an indicator of attribution. The targeting profile, decoy construction and operational characteristics of the two campaigns are consistent with an espionage-oriented actor operating in Southeast Asia: the campaigns were deliberately targeted at Cambodian government entities in the defense and public works sectors, indicating a clear intelligence objective. At the same time, the combination of a custom C++ loader, KaynLdr, and Havoc Demon does not resemble any cluster previously documented by TRU, and the infrastructure shows no significant overlap with known threat groups. As a result, the activity is not currently attributed to any known actor and TRU continues to identify it as a previously unreported cluster designated as Khmer Shadow.
The campaign reflects a cluster that has prioritized stealth over operational security. While employing advanced evasion techniques, including NTDLL unhooking, Hell's Gate syscall resolution, and DLL sideloading, Khmer Shadow repeatedly reused the same payloads and infrastructure against multiple targets. This inconsistency enabled infrastructure correlation and led to the identification of additional assets controlled by the cluster via JARM-based pivots.
