Threat actors are exploiting the high-pressure environment of university compliance to deploy stealthy malware.
Seqrite Labs recently uncovered “Operation Dragon Whistle,” a highly targeted spear-phishing campaign aiming at Changzhou University in China.
The attackers, identified with medium-high confidence as the UNG0002 group, use the mandatory 2026 fitness testing cycle as a powerful social engineering lure.
The attackers display deep institutional knowledge by including real staff names, phone numbers, and official seals in their decoy documents.
This creates a severe sense of urgency, as failing the fitness assessment directly impacts a student’s graduation eligibility.
Dragon Whistle Deploys Cobalt
The campaign begins with a phishing email from a spoofed sender delivering a ZIP attachment. This file mimics an official university notice but contains a complex, multi-stage infection mechanism designed to evade detection.
The initial interaction begins when a victim clicks a double-extension LNK file disguised as a PDF. The LNK triggers a lightweight VBScript that opens a legitimate decoy document while silently executing malicious background processes.
A legitimate archiving tool called Bandizip is weaponized to perform DLL sideloading by loading an attacker-controlled file.
The malware checks for active debugging tools and security environments before unpacking a payload directly into memory to deploy a Cobalt Strike Beacon.
By executing the payload entirely in memory, the malware minimizes on-disk artifacts and reduces forensic visibility.
The script also employs evasion techniques to bypass Windows security mechanisms, such as the Antimalware Scan Interface.
According to Seqrite research, the threat actors meticulously built their infrastructure using Alibaba Cloud to blend in with regional traffic.
They rotated their hosting providers from previous operations to evade network blocking based on autonomous system numbers.
The use of domestic Chinese enterprise tools and domain registrars further anchors the operation’s highly targeted nature.
Indicators of Compromise
| File Description | SHA256 Hash |
|---|---|
| Malicious ZIP Attachment | e7aff6a55a7866776272d9913dfbf9d7db33fc9de6aced22f2a195feebb0e85f |
| Decoy PDF | fe11b199ada23d5ac25efc4215e67f4ff617ccb4d429eb64412072687367ca1c |
| LNK Payload | cd99e83d241cfbb41bfcd0bc622a87d16268e710ca7d736d0c5f44774e0056e2 |
| Weaponized Bandizip.exe | c937eca7c4c9b98df9257d986e666d25411aac5fa39d21f7018dd2e1663f0c76 |
| Malicious ark.x64.dll | 35a478f53f64bd412f374c65360fdba0518749537193669a8fe08d14bed65a2a |
| Cobalt Strike Beacon | ed7087e3afba4b320bdf04f32d3a6c567effd3d18a97682968e567000e70b335 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
