Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

Amaranth-Dragon Exploits WinRAR Vulnerability for Persistent Access to Victim Systems

## Cybersecurity: Amaranth-Dragon Threat Overview

ZBy Zachary BurnsFeb 05, 20261 min read

Cybersecurity: Amaranth-Dragon Threat Overview

A cyber-espionage group, named Amaranth-Dragon, has been identified as conducting targeted attacks against governmental and law enforcement entities in Southeast Asia throughout 2025. Evidence suggests a connection to APT-41, a known Chinese state-sponsored hacking group, due to shared tools and operational time zones (UTC+8).

Amaranth-Dragon employs a "path traversal" vulnerability in WinRAR, identified as CVE-2025-8088. This vulnerability allows the creation of malicious RAR archives that deposit files into restricted areas on a victim's computer without authorization. The group utilizes this to place a malicious script in the Windows Startup folder, ensuring persistent access by executing the malware upon system reboot.

Amaranth Loader: A custom tool used to "side-load" onto legitimate files, retrieving encrypted payloads from attacker-controlled servers. Havoc C2 Framework: Installed by the loader, this open-source command-and-control system allows remote management of infected devices. Cloudflare Geofencing: Servers are protected behind Cloudflare and configured to accept connections only from specific countries, such as Thailand and Indonesia, blocking other regions with a 403 error.

Evidence suggests a connection to APT-41, a known Chinese state-sponsored hacking group, due to shared tools and operational time zones (UTC+8).
Zachary Burns · Thehackingpost

In September 2025, a new remote access trojan, TGAmaranth RAT, was introduced. It uses Telegram bots for sending and receiving commands, disguising malicious traffic as normal chat application usage. This tool features advanced evasion capabilities against antivirus software and Endpoint Detection and Response (EDR) systems by unhooking security monitoring tools from system memory.

Amaranth-Dragon's sophisticated techniques, including the rapid adoption of vulnerabilities like CVE-2025-8088 and precise geopolitical targeting, have allowed them to compromise high-value targets effectively. The use of legitimate services such as Dropbox and Telegram further complicates tracking and mitigation efforts.

Advertisement

Based on reporting by GBHackers.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026