Cambodia Security Report — November 11, 2026

Security analysis based on open-source intelligence and web research. Period: November 04 — November 11, 2026.

Executive Summary

Cambodia's security landscape from November 04 to November 11, 2026, was characterized by significant diplomatic engagements, a notable shift in defense policy, and persistent cyber threats. The nation launched its first military conscription training, aiming to bolster its armed forces amidst ongoing border tensions with Thailand. Diplomatic ties with both the European Union and China were strengthened through high-level dialogues focused on trade, investment, and regional stability, while a new US Ambassador arrived, signaling renewed security cooperation. Concurrently, Cambodia continued its crackdown on pervasive online scam operations, even as a Cambodia-based cybercrime group, Storm-3358, was identified using advanced AI hacking tools to target financial institutions.

Key Security Developments

• Military Conscription Training Launched
  On November 9, 2026, Cambodia officially launched its first wave of military training under a newly enacted conscription law at a military base in western Kampong Speu province. Prime Minister Hun Manet hailed this as a historic milestone, emphasizing its role in strengthening recruits' bodies and spirits and enhancing the Royal Cambodian Armed Forces (RCAF). This initiative, which aims to recruit 10,000 citizens aged 18 to 25 for a 24-month term, marks a significant shift in Cambodia's defense policy, activated from a law passed in 2006.

• Persistent Cambodia-Thailand Border Tensions
  Tensions along the 800km land border with Thailand remained high during this period, with Cambodia reporting that Thai troops had moved an observation post and dug trenches approximately 20 meters forward from their previous position on November 5, 2026. Cambodia urged the immediate start of border demarcation work, and the ASEAN Observer Team (AOT) conducted a verification mission to the Chey Chomneas Border Checkpoint in Pursat province on November 4, 2026, to assess the situation. Around 24,000 civilians remain displaced along the border, with Cambodia accusing Thailand of preventing their return despite a ceasefire agreement.

• Deepening Cambodia-China Diplomatic and Security Ties
  On November 4, 2026, Cambodian Deputy Prime Minister and Foreign Minister Prak Sokhonn met with Chinese Foreign Minister Wang Yi in Beijing on the sidelines of the 11th Lancang-Mekong Cooperation (LMC) Foreign Ministers' Meeting. China reaffirmed its support for Cambodia's development path and expressed readiness to strengthen strategic communication and jointly meet external challenges. The discussions also covered enhancing bilateral law enforcement and security cooperation, particularly in cracking down on online gambling and telecom fraud crimes.

• Renewed Cambodia-US Defense Cooperation
  The United States and Cambodia concluded their 2026 Bilateral Defense Discussion (BDD) in Phnom Penh on November 4, 2026, with the signing of a landmark Terms of Reference (ToR) between the U.S. Pacific Command and Cambodia's Ministry of National Defense. This agreement establishes a framework for bilateral defense cooperation, including initiatives in maritime security, special forces collaboration, joint bilateral exercises (like the upcoming Angkor Sentinel in 2027), professional military education, and medical cooperation.

• New US Ambassador to Cambodia Presents Credentials
  On November 10, 2026, the new US Ambassador Extraordinary and Plenipotentiary, Christopher Anderson, formally began his diplomatic mission in Cambodia after presenting his credentials to King Norodom Sihamoni at the Royal Palace in Phnom Penh. Ambassador Anderson pledged to strengthen US-Cambodia relations, expand trade and security cooperation, and combat transnational crime, signaling renewed momentum in bilateral ties.

• US Sanctions on Cambodia-based Cyberscam Group
  The United States imposed sanctions on November 5, 2026, on four individuals and 41 companies linked to the "Prince Group," an alleged Cambodia-based cyberscam operation accused of running a billion-dollar scam. The US Treasury Department highlighted Cambodia's emergence as a hub for crime syndicates involved in fake romantic relationship and cryptocurrency investment schemes, with some scammers being trafficked.

• Microsoft Identifies Cambodia-based AI Hacking Group
  Microsoft Threat Intelligence identified "Storm-3358" as a Cambodia-based intrusion cluster that began targeting financial organizations in Southeast Asia and globally in October 2026. This financially motivated threat actor is reportedly using the agentic AI offensive framework ARTEX to scan and exploit vulnerabilities in web applications, install remote access trojans (RATs), and accelerate attack chains.

• Cambodia's Ongoing Crackdown on Online Scams
  Cambodia reported significant progress in its nationwide crackdown on online scams, with actions taken against 972 locations and the detention of 5,032 suspects, leading to the repatriation of 23,760 foreign nationals between July 2025 and October 2026. The Commission for Combating Online Scams (CCOS) reaffirmed Cambodia's commitment to international cooperation against these crimes and is conducting in-depth investigations into financial networks and cryptocurrency use.

• Cambodia-EU Dialogue on Trade and Investment
  The 5th Cambodia-Europe Public and Private Sector Dialogue was held in Phnom Penh on November 4, 2026, co-chaired by Deputy Prime Minister Sun Chanthol and EU Ambassador Igor Driesmans. The dialogue focused on deepening trade and investment cooperation, evaluating economic reforms, and future investment initiatives, including progress on the expansion of the Sihanoukville deep-sea port, expected to reduce maritime transport costs by 30% by mid-2027.

• China Facilitates Cambodia-Thailand Border Dispute Dialogue
  During the LMC Foreign Ministers' Meeting on November 4, 2026, Chinese Foreign Minister Wang Yi invited the Cambodian and Thai foreign ministers to an informal tea talk, which Cambodian Deputy Prime Minister Prak Sokhonn appreciated as embodying China's constructive position of settling the Cambodia-Thailand dispute through peace and dialogue. This highlights China's growing role in regional mediation efforts.

Cyber Threat Landscape

Cambodia faced an Elevated cyber threat landscape during this period, marked by both financially motivated cybercrime and the emergence of sophisticated AI-driven hacking campaigns. Microsoft Threat Intelligence identified Storm-3358 as a Cambodia-based intrusion cluster actively targeting financial organizations in Southeast Asia and globally since October 2026. This group is leveraging the ARTEX AI offensive framework to autonomously scan and exploit web application vulnerabilities, deploy web shells for persistence, and install remote access trojans (RATs) such as WISP, vshell, and AdaptixC2. The use of agentic AI platforms like ARTEX, which can perform brute-force attacks, API enumeration, and database dumping at machine speed, significantly accelerates attack chains and poses a severe threat to the financial sector.

Further insights into the ARTEX framework were provided by Check Point Research in their "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns" report published on November 6, 2026. The report detailed that ARTEX, an open-source AI-powered penetration testing platform, is being widely adopted by cybercriminals for opportunistic, financially motivated attacks. Over 1,800 publicly exposed instances of ARTEX were observed, with attacks largely autonomous and primarily utilizing Chinese AI models like Deepseek Flash. While the report did not name specific Cambodian victims, it underscored the global reach and accessibility of these advanced hacking tools for criminal enterprises.

The Cambodian government continues its efforts to combat online scams, reporting that between July 2025 and October 2026, authorities took action against 972 locations and detained 5,032 suspects. The US sanctions on the "Prince Group" on November 5, 2026, further highlighted the scale of the issue, identifying it as a billion-dollar scam operation. Background: Threat actors known to target Cambodia include APT40, Naikon, Aoqin Dragon, and RANCOR, all linked to China.

Geopolitical Impact and Regional Dynamics

Cambodia's recent security and diplomatic developments have notable implications for regional stability and its relations with major powers. The launch of military conscription signals a move towards strengthening national defense capabilities, which could be interpreted by neighboring countries as either a stabilizing force or a potential escalation, particularly given the ongoing border disputes with Thailand. The persistent tensions along the Cambodia-Thailand border, including accusations of troop movements and civilian displacement, remain a critical flashpoint that requires careful diplomatic management to prevent renewed conflict. China's active role in facilitating dialogue between Cambodia and Thailand on border issues, as seen during the Lancang-Mekong Cooperation meeting, underscores Beijing's growing influence as a regional mediator and its strategic interest in maintaining stability in Southeast Asia.

The renewed defense cooperation with the United States, marked by the signing of a Terms of Reference and the upcoming "Angkor Sentinel 2027" exercise, represents a pragmatic effort by Cambodia to diversify its security partnerships and enhance its military capabilities. This move, however, occurs against a backdrop of continued US concerns regarding China's military presence at Ream Naval Base. While Cambodia maintains that the base is not for the exclusive use of any foreign power, the dual engagement with both China and the US reflects Cambodia's delicate balancing act in navigating major power competition in the Indo-Pacific. The new US Ambassador's commitment to strengthening security cooperation and combating transnational crime further solidifies the US's interest in Cambodia's internal stability and regional role.

The ongoing crackdown on cybercrime and the US sanctions against the "Prince Group" highlight the transnational nature of these threats and the need for international cooperation. Cambodia's efforts to combat online scams, while crucial for its own security and international reputation, also align with the interests of countries like the US and China, which have been impacted by these criminal networks. The identification of the Cambodia-based Storm-3358 group using AI hacking tools further complicates the regional cyber threat landscape, posing risks to financial institutions across Southeast Asia.

EU Relations and Implications

Cambodia's relations with the European Union during this period were primarily focused on strengthening economic and trade cooperation. The 5th Cambodia-Europe Public and Private Sector Dialogue on November 4, 2026, saw discussions aimed at deepening trade and investment, evaluating key economic reforms, and attracting European investors. EU Ambassador Igor Driesmans commended Cambodia's reform agenda and expressed optimism for Cambodia's future transition toward the EU's GSP+ preferential trade framework, which would continue to grant tariff-free access for sustainable exports. The dialogue also highlighted progress on the expansion of the Sihanoukville deep-sea port, a critical infrastructure project supported by the EU's development cooperation, which is expected to enhance Cambodia's international market competitiveness.

The security and cyber developments have direct implications for EU interests and cooperation projects in Cambodia. The EU's assessed relationship outlook with Cambodia was "Stable" as of August 2026, with cooperation projects spanning infrastructure, education, development, trade, and governance. The ongoing efforts to combat online fraud, a concern previously raised by the EU, are crucial for maintaining investor confidence and ensuring good governance, which aligns with EU-funded initiatives in the Governance & Rule of Law sector. While the EU has expressed concerns related to human rights and good governance, the focus during this period was on economic engagement, suggesting a continued pragmatic approach to the relationship. The cyber threats posed by groups like Storm-3358 could impact European businesses operating in Cambodia or those with supply chain links to the region, necessitating robust cybersecurity measures and potential collaboration on digital security, building on existing digital projects like SCOPE Digital.

Military and Defense Analysis

Cambodia's military and defense posture saw a significant development with the launch of its first military conscription training on November 9, 2026, in Kampong Speu province. This initiative, aimed at recruiting 10,000 citizens aged 18 to 25 for a two-year term, is a direct effort to strengthen the Royal Cambodian Armed Forces (RCAF) and instill civic duty. The conscripts will undergo instruction in military tactics, discipline, professional conduct, and learn military and technical skills, indicating a focus on enhancing both the size and professionalization of the armed forces. This move is particularly relevant given the persistent border tensions with Thailand, which continue to displace civilians and pose a risk of renewed conflict.

In terms of modernization and capability development, Cambodia is balancing its long-standing close ties with China with a renewed engagement with the United States. The signing of a Terms of Reference with the U.S. Pacific Command on November 4, 2026, establishes a framework for bilateral defense cooperation, including maritime security, special forces collaboration, and professional military education. This agreement paves the way for the resumption of the "Angkor Sentinel 2027" joint military exercise with the US, which aims to strengthen interoperability and disaster-response capabilities. While these developments suggest a diversification of defense training and potential acquisition options, concerns persist regarding China's military presence at Ream Naval Base, which the US views with suspicion despite Cambodian denials of exclusive Chinese rights. Cambodia's defense spending trends were not explicitly detailed in the available news for this period, but the conscription program suggests an investment in human capital for its armed forces.

Outlook and Forecast

Short-term trends (1-3 months): In the immediate future, Cambodia is likely to continue its dual-track approach of strengthening domestic defense capabilities through conscription while balancing diplomatic and security ties with major powers. The military conscription program will be a key focus, with initial training phases likely to be closely monitored for effectiveness and public reception. Border tensions with Thailand are expected to remain a critical concern, with diplomatic efforts continuing to address the fragile land and maritime boundaries. The upcoming third meeting of the UNCLOS Conciliation Commission in Kuala Lumpur from November 24-27, 2026, will be a significant event for the maritime dispute. In the cyber realm, the crackdown on online scams will likely intensify, potentially leading to more arrests and repatriations, while organizations will need to heighten their defenses against sophisticated AI-driven attacks from groups like Storm-3358.

Critical flashpoints and risk areas: The Cambodia-Thailand border remains the most critical flashpoint, with the risk of renewed localized clashes due to unresolved territorial disputes and accusations of ceasefire violations. Any further troop movements or incidents involving displaced civilians could quickly escalate. The proliferation of AI-powered hacking tools, as demonstrated by ARTEX and its use by Storm-3358, poses a significant and evolving risk to Cambodia's financial sector and critical infrastructure. The delicate balance in Cambodia's relations with the US and China, particularly concerning Ream Naval Base, could become a flashpoint if either power perceives a shift in alignment or an exclusive military presence.

Indicators to monitor: Key indicators to monitor include the progress and public acceptance of the military conscription program, any new developments or incidents along the Cambodia-Thailand border, and the outcomes of the UNCLOS conciliation meetings. In the cyber domain, tracking reports of further activities by Storm-3358 or other advanced persistent threats (APTs) targeting Cambodian entities, as well as the government's effectiveness in dismantling online scam networks, will be crucial. Diplomatic statements and actions from the US, China, and the EU regarding Cambodia's security posture and regional engagements should also be closely watched for shifts in policy or increased pressure.

Strategic recommendations: Cambodia should prioritize de-escalation mechanisms and confidence-building measures with Thailand to manage border tensions and protect displaced populations. Investing in advanced cybersecurity defenses and international cooperation to counter AI-driven cyber threats and transnational scam operations is paramount. Furthermore, Cambodia should continue to articulate a clear and transparent defense policy regarding its foreign military engagements, particularly concerning Ream Naval Base, to maintain strategic autonomy and reassure international partners. Diversifying defense partnerships while maintaining strong economic ties with all major powers will be key to navigating the complex geopolitical landscape.

Sources

• news.cn
• securitystudies.info
• youtube.com
• cambojanews.com
• www.gov.cn
• kps-tv.com
• cpp.org.kh
• chinadaily.com.cn
• news.cn
• bignewsnetwork.com
• theconwe.com
• kiripost.com
• thestar.com.my
• sanctity.ai
• microsoft.com
• khmertimeskh.com
• kampucheathmey.com
• khmertimeskh.com
• youtube.com
• checkpoint.com
• explainx.ai
• ground.news
• apnews.com
• dvb.no
• thaipbsworld.com
• thestar.com.my
• mynorthwest.com
• scmp.com
• khmertimeskh.com
• europa.eu
• khmertimeskh.com
• cambojanews.com