China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns

Threat actors linked to China—tracked as Amaranth-Dragon and tied to the APT41 ecosystem—conducted targeted espionage across Southeast Asia in 2025 by weaponizing CVE-2025-8088 in WinRAR and using malicious archives, DLL side-loading, and living-off-the-land techniques to deploy Havoc C2 and custom RATs (including TGAmaranth); separately, Mustang Panda used LNK-based lures and DLL search-order hijacking to deliver a PlugX variant (DOPLUGS) against diplomatic and policy targets, with campaigns showing high operational discipline, geo-restricted C2, and active exploitation of vulnerabilities and social-engineered lures.