Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector

Seqrite TRU reports a targeted multi-stage malware campaign active between April and June 2026 against Thailand's healthcare sector. Attackers distribute RAR archives containing heavily obfuscated batch loaders that deploy GitHub-hosted payloads, persist via Startup-folder scripts, extract and run a bundled Python-based stealer (sim.py) that harvests browser credentials and attempts exfiltration via the Telegram Bot API; the report provides technical analysis, IOCs (file hashes and filenames), and MITRE ATT&CK mappings.