{
  "name": "Threat Actors Weaponizing RAR Archives to Target Thailand's Healthcare Sector",
  "slug": "threat-actors-weaponizing-rar-archives-to-target-thailands-healthcare-sector",
  "description": "An active malware campaign is targeting Thailand's healthcare sector, including Ministry of Health personnel and affiliated organizations. The operation leverages healthcare-themed spear-phishing lures distributed through malicious RAR archives containing obfuscated batch scripts and executable payloads. The infection chain employs multiple stages of obfuscation, GitHub-hosted payload delivery, and persistence mechanisms. The final payload is a Python-based information stealer designed to harvest browser credentials, session data, and cookies, with exfiltration attempts through Telegram Bot API. The campaign demonstrates sophisticated tradecraft including Rouki-obfuscated batch loaders, Startup folder persistence, and bundled Python interpreters. Active operational window spans from April to June 2026, with all samples uploaded from Thailand.",
  "published": "2026-06-19T14:27:26.020000+00:00",
  "created_at": "2026-06-22T09:30:14.731000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-06-22T09:30:14.731000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "batch script obfuscation",
    "github payload hosting",
    "python stealer",
    "rouki obfuscation"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "610cc299-246b-4a36-918b-4930332a8016",
        "name": "7709d8c34d490509f3624104611eb75a862944dd9d7a642f44514ada16c85ee9"
      },
      {
        "id": "74e53faa-5c29-47db-b9f9-40fcccaeb8eb",
        "name": "f4d4b8cac004bb63834c6df436721babd9464c09787c80b268d839e0aada9f87"
      },
      {
        "id": "10b0da3c-1c70-4bf1-bef8-d1909faf3269",
        "name": "74bb6ad7e1310f30a3e24fd3cbbffa2c0c41c64e89e5d0dd1d6900e96b914183"
      },
      {
        "id": "bdc00cba-c08b-40d1-b608-6ee705fc556f",
        "name": "4eebc38297a307d18784d6f9ebc8aa6e6f69860be970cc70d9e544deb1ff6ce0"
      },
      {
        "id": "083a8d97-3b7f-49b1-82cd-b0d41bafa79b",
        "name": "523388567630e4fbdc359f75232bf2ad82671a680d4bfdce0237fc30dfec4c80"
      },
      {
        "id": "47a8ea08-ad98-4f8e-8f83-86bc31e499b0",
        "name": "442e0f4e822842922e7e4685840194e99fd68c7f0ec38c1925914b8f724d5865"
      },
      {
        "id": "d8e32311-e208-4e8e-8b3f-6dfc90df0870",
        "name": "e5f6d9d405819e6b05b5d8268a2e973294859ad65237ede36ab612b536d0ac2b"
      }
    ],
    "attack_patterns": [
      {
        "id": "e73b317e-ea92-49b4-a45d-051f7279aced",
        "name": "T1213"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "1f2ce0cc-430c-4317-a332-83a27cbad1d3",
        "name": "T1548"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "b7ba0db0-7d4f-436f-8d5f-c431d690b048",
        "name": "T1555.003"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "31d29704-da1c-47ea-b93f-76d368813bdf",
        "name": "T1560"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "14e5fcd9-c0ff-44f0-8430-d8942ebb832e",
        "name": "T1567.002"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "232fbdfa-94c6-443d-b575-373e75b4f4c2",
        "name": "T1567"
      }
    ],
    "malware": [
      {
        "id": "6e32e1ac-678f-4cee-9458-8c77c3bbfe5d",
        "name": "sim.py",
        "slug": "simpy"
      }
    ]
  },
  "external_refs": [
    {
      "id": "2b08d239-6e1d-49c0-a831-23a593ac5206",
      "standard_id": "external-reference--8002a6ce-d96d-5eda-98ca-203e802df2e7",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.seqrite.com/blog/threat-actors-weaponizing-rar-archives-to-target-thailands-healthcare-sector/",
      "hash": null,
      "external_id": null,
      "created": "2026-06-22T09:30:14.602Z",
      "modified": "2026-06-22T09:30:14.602Z",
      "createdById": null
    },
    {
      "id": "53bd7f13-e399-43f7-a1a8-f74fb39bf5ef",
      "standard_id": "external-reference--ee2e5340-6ebe-5873-ae45-996c8b11e73b",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a3551ceb394e391f2a341f1",
      "hash": null,
      "external_id": "6a3551ceb394e391f2a341f1",
      "created": "2026-06-22T09:30:14.557Z",
      "modified": "2026-06-22T09:30:14.557Z",
      "createdById": null
    }
  ]
}