Amaranth-Dragon — APT Profile

Amaranth-Dragon is a previously untracked threat actor assessed to be closely linked to the China-affiliated APT 41 ecosystem, exhibiting similar tooling and operational patterns. The group demonstrated technical maturity by rapidly operationalizing CVE-2025-8088, a vulnerability in WinRAR, shortly after its public disclosure. Check Point Research has identified multiple campaigns targeting Cambodia, Thailand, Laos, Indonesia, Singapore, and the Philippines, with operations typically focused on one or two countries at a time. The overlaps in technical and operational indicators strongly suggest that Amaranth-Dragon is either affiliated with or part of the broader APT-41 ecosystem.

Tools & malware

Amaranth Loader Loader
Havoc C2 Framework
TGAmaranth RAT Remote Access Trojan

Vendor research

Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia Check Point Research
Amaranth-Dragon: Targeted Cyber Espionage Campaigns Across Southeast Asia Check Point Software

Countries linked to this actor

Cambodia targets

Read the full analysis on IntelFusions