
- Amaranth Dragon, linked to APT41, joins groups exploiting WinRAR CVE-2025-8088
- Targets include organizations across Southeast Asia, using custom loaders and Cloudflare-masked servers
- Vulnerability abused since mid-2025 by multiple state actors, with malware hidden via Alternate Data Streams