VMware Bug Lets Attackers Sideload Malware in Espionage Attacks

Key Takeaways

• An ongoing espionage campaign, “Khmer Shadow,” is targeting Cambodian government entities.
• Threat actors are leveraging a legitimate, signed VMware binary (VmwareSampling.exe) for DLL sideloading to deploy the sophisticated NIGHTFORGE loader.
• NIGHTFORGE employs advanced evasion techniques, including NT DLL unhooking and HellsGate, to inject the Havoc Demon post-exploitation framework.
• The campaign utilizes government-themed phishing lures and establishes persistence via a scheduled task named “VmwareSampling.”
• Acronis researchers recommend strict controls on DLL loading, application allowlisting, and enhanced monitoring for malicious scheduled tasks and in-memory evasion tactics.

A sophisticated espionage campaign has been uncovered, meticulously targeting Cambodian government institutions through an advanced sideloading technique. Cybersecurity researchers report that threat actors are exploiting a legitimate, digitally signed VMware binary to stealthily deploy a custom malicious loader dubbed NIGHTFORGE. This method is designed to ensure covert operation and maintain persistent access within compromised environments.

The campaign, detailed by Acronis’ Threat Research Unit (TRU), is part of a broader operation named “Khmer Shadow.” This operation leverages DLL sideloading, a technique where attackers can execute malicious code by placing a malicious DLL in a location where a trusted application expects to load a legitimate one. This allows the malicious code to run under the guise of a trusted process, effectively bypassing many traditional security defenses.

Acronis TRU’s analysis suggests “Khmer Shadow” is primarily focused on intelligence gathering. The identified targets include agencies related to national defense and public infrastructure within Cambodia, indicating a strategic interest in regional intelligence rather than financial motivations. The sophistication of the tactics employed points to a well-resourced threat actor with a deep understanding of evasion techniques and a clear interest in Southeast Asian geopolitical affairs.

Researchers at Acronis TRU have identified two closely related but distinct espionage operations under the “Khmer Shadow” umbrella. These operations share nearly identical tooling and infrastructure, strongly indicating a single threat cluster, which Acronis tracks as “Amber Saolao.” Both campaigns utilize the same custom loader, the same final payload, and even common command-and-control (C2) infrastructure. Initial compromise in both cases involved government-themed lure documents, designed to trick recipients into initiating the infection chain. The consistent reuse of these elements suggests a mature and persistent threat group operating for a significant period.

Advanced Sideloading and Evasion Techniques

A key aspect of this threat is the abuse of VmwareSampling.exe, a legitimate executable signed by VMware. This particular binary is exploited to load malicious code, a tactic that often allows attackers to evade detection by security products that typically trust digitally signed executables.

Initial Infection and Payload Delivery

The attack chain typically commences with a phishing email delivering a compressed archive. Inside this archive, victims find a document crafted to appear as legitimate diplomatic communication, alongside the signed VMware executable and a malicious DLL. Both the legitimate executable and the malicious DLL are strategically placed in the same directory. When the victim executes the seemingly innocuous document, the VmwareSampling.exe binary is launched, which then inadvertently loads the malicious DLL. This malicious DLL acts as the NIGHTFORGE loader, initiating the subsequent stages of the attack.

NIGHTFORGE is far from a simple dropper. It incorporates advanced evasion mechanisms, including NT DLL unhooking, a technique that removes monitoring hooks placed by security tools on Windows system calls. Furthermore, it employs a method known as HellsGate to dynamically resolve system call numbers at runtime, thereby bypassing conventional API paths typically monitored by security solutions. Once these evasion maneuvers are complete, the loader decrypts and injects a Havoc Demon payload directly into memory, leaving no encrypted file traces on the disk.

Havoc Demon is an open-source post-exploitation framework, frequently utilized in red team exercises but increasingly observed in real-world attacks. This framework grants attackers comprehensive remote control over compromised systems, enabling command execution, file access, and credential harvesting. The implant’s communication with its C2 servers occurs over port 443, a common port for HTTPS traffic, allowing it to blend seamlessly with normal web activity and evade network monitoring tools.

Persistence and Command-and-Control Infrastructure

Upon successful execution, NIGHTFORGE establishes persistence on the infected machine by creating a scheduled task. This task is deliberately named “VmwareSampling,” mirroring the legitimate VMware binary it exploited. This naming convention helps the malicious task blend in with legitimate VMware-related entries, reducing the likelihood of detection by system administrators reviewing scheduled tasks.

The C2 infrastructure used across both identified campaigns is strikingly similar. The primary C2 domain for the Havoc Demon implant was identified as saornfila[.]loU. Traffic to this domain was routed through a Cloudflare-based reverse proxy, designed to obfuscate the true origin server. Analysis revealed the actual backend server was hosted in Ukraine, with a secondary, previously unknown server located in the United States also linked to a connected domain.

What You Should Do

• Enforce Strict DLL Loading Controls: Implement policies that restrict where DLLs can be loaded from, prioritizing trusted system directories.
• Apply Application Allowlisting: Utilize application allowlisting solutions to prevent the execution of unauthorized binaries and scripts, even if they are digitally signed.
• Monitor Scheduled Tasks: Regularly audit and monitor newly created or modified scheduled tasks, especially those mimicking legitimate software names like “VmwareSampling.”
• Configure Alerts for In-Memory Evasion: Set up alerts for processes performing NT DLL map-and-overwrite operations, as this is a strong indicator of advanced in-memory evasion tactics used by this loader family.
• Enhance Phishing Awareness: Conduct regular training for employees on identifying and reporting phishing attempts, particularly those using government-themed lure documents.
• Review Network Traffic: Monitor outbound network connections for suspicious activity over common ports like 443, looking for unusual patterns or connections to known malicious C2 domains.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.