Amaranth Dragon: Targeted Espionage via CVE 2025 8088

Du'aine Davis

Observed in the wild

• Throughout 2025, Amaranth‑Dragon, an APT‑41‑aligned Chinese cyber‑espionage group, conducted highly targeted campaigns against government and law‑enforcement bodies across Southeast Asia. Their lures aligned with local geopolitical events, increasing victim engagement, with operations concentrated in countries including Cambodia, Thailand, Laos, Indonesia, Singapore, and the Philippines. [
• Less than ten days after disclosure of CVE‑2025‑8088, the group weaponised malicious WinRAR archives to achieve arbitrary code execution and persistence by dropping scripts into the Startup folder. They used the custom Amaranth Loader for DLL‑sideloading, in‑memory decryption of AES‑encrypted payloads (notably Havoc C2), Cloudflare‑protected geo‑restricted C2 servers, and introduced TGAmaranth RAT with anti‑EDR/AV capabilities.
• Organisations should promptly patch WinRAR to eliminate CVE‑2025‑8088 exploitation, monitor for suspicious RAR archive extraction and Startup‑folder file creation, and detect DLL‑sideloading patterns consistent with Amaranth Loader behaviour. Defender telemetry should watch for AES‑encrypted payload retrieval, geo‑restricted Cloudflare‑based C2 patterns, and Telegram‑bot‑based RAT activity.

Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia - Check Point Research