Operation Dragon Whistle: UNG002 Targets Chinese Academia via Weaponized Institutional Lure

Summary of Operation Dragon Whistle Analysis

Overview: Operation Dragon Whistle is a sophisticated cyber campaign targeting educational institutions in China, particularly focusing on universities and research institutes. The threat actor leverages highly customized malware to gain unauthorized access to sensitive information and intellectual property.

Key Findings:

1. Initial Infection Vector (IIV):

   • LNK Files: Malicious LNK files are used as the primary delivery mechanism, similar to previous campaigns.
   • VBScript Obfuscation: The malware is delivered via obfuscated VBScript embedded within these LNK files.

2. Payload Delivery:

   • Bandizip Living Off the Land (LOTL): Bandizip, a legitimate archive management tool from South Korea, is weaponized to execute malicious payloads.
   • Ark.x64.dll: A custom DLL named ark.x64.dll is placed alongside the legitimate Bandizip executable. This DLL contains anti-debugging and evasion techniques.

3. Anti-Debugging Techniques:

   • The malware employs various anti-analysis mechanisms, including timing-based checks (GetTickCount), process enumeration, and API calls like CheckRemoteDebuggerPresent, `Is

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.