Hackers Abuse VMware-Signed Binary to Sideload NIGHTFORGE Loader

A newly identified threat cluster dubbed “Khmer Shadow” has launched targeted espionage campaigns against Cambodian government entities.

Acronis Threat Research Unit (TRU) recently uncovered these attacks, which zero in on the defense, military intelligence, and public works sectors.

To compromise these high-value targets, the hackers use a clever evasion technique: abusing a legitimate, digitally signed VMware binary to quietly load a custom piece of malware called the NIGHTFORGE loader.

The attackers rely on a classic but highly effective initial access vector. The campaign begins with a spear-phishing email containing a self-extracting archive that masquerades as a harmless PDF document.

In an attack targeting Cambodia’s Information Collection Bureau, the decoy document appeared to be a routine letter discussing bilateral coordination and site visits between Cambodia and China.

The lure was carefully crafted with specific references to fabricated defense personnel, ensuring the target would open it without a second thought.

VMware Binary Sideloads NIGHTFORGE

When a victim opens the fake document, the archive silently extracts a legitimate VMware executable, VMwareNamespaceCmd.exe, alongside a malicious file, vmtools.dll. Because Windows fully trusts the VMware application, it automatically loads the malicious DLL into its memory a technique known as DLL sideloading.

Once loaded, the attacker-controlled DLL acts as the NIGHTFORGE loader, executing under the trusted context of the VMware process.

NIGHTFORGE is a custom C++ tool designed specifically to evade detection and establish a quiet foothold. Before running its core routines, it checks the environment to ensure it is not running in a sandbox. It hides any foreground windows, keeping the victim in the dark.

To bypass modern endpoint detection and response systems, NIGHTFORGE employs advanced defense-evasion methods.

First, it unhooks the NTDLL, replacing the in-memory copy with a clean version from the disk. This essentially removes the inline hooks that security software uses to monitor for malicious behavior.

Furthermore, it uses the Hell’s Gate technique to dynamically resolve system calls.

This allows the loader to interact directly with the core of the operating system, writing memory and creating threads without triggering alarms from user-mode security monitoring tools.

Once active, the Havoc Demon implant reaches out to attacker-controlled servers over an encrypted connection. To avoid raising suspicion on the network, the malware disguises its communications as standard Google Chrome web browsing traffic.

It uses realistic HTTP headers and rotates its requests across fake directory paths to mimic a user casually reading a news website.

Despite their sophisticated evasion techniques, the Khmer Shadow group struggles with basic operational security.

Acronis researchers noted that the attackers reused identical payloads and server setups across multiple targets with almost no changes.

This laziness allowed threat hunters to pivot using server fingerprints and uncover additional hidden infrastructure, effectively mapping out the threat actor’s network.

Indicators of Compromise

Indicator	Type	Description
1852120a84a328edd1995e633dfd2009867898a8e3f0b385e2490cf21c77a994	SHA256 Hash	Contact_Letter_To_Ms_Pech_ICB_Cambodia_On_Collaboration.pdf.exe (SFX Archive)
b3e853eee14fb7948c6907888ee07139085ba9af4231c30e97ff6236b86ca024	SHA256 Hash	CN_Contact_Work_Cambodia's_Ministry_of_Public_Works_and_Transport.pdf (SFX Archive)
90bbfa9e7af176b85d110f4f1789cae6777fcb60813b047133c8f12caa344a17	SHA256 Hash	Havoc Demon payload

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.