On 2026-05-20, Seqrite Labs (Quick Heal Technologies) — authored by Dixit Panchal, Kartik Jivani, and Vaibhav Krushna Billade — disclosed Operation Dragon Whistle, a precision spear-phishing campaign attributed with medium-high confidence to threat actor UNG0002 targeting Mainland China's higher-education sector. The operation specifically singled out Changzhou University (常州大学) students and faculty, weaponizing the institution's mandatory 2026 National Student Physical Fitness and Health Standards (《国家学生体质健康标准》) testing cycle — a graduation-critical compliance event — as the social-engineering lure.

INITIAL ACCESS: A spear-phishing email was sent from the address 18115820617@163.com under the display name '牛牛 (Cow Cat)' using NetEase's free 163.com mail service, deliberately chosen to bypass enterprise mail security scrutiny applied to unknown external domains. The email carried a ZIP attachment named '常州大学2026年《国家学生体质健康标准》测试通知最终版.zip' (Changzhou University 2026 National Student Physical Fitness and Health Standards Testing Notice — Final Version). The body content referenced the graduation-critical nature of the fitness assessment, real staff names, direct phone numbers, an active QQ group ID, and the official institutional seal — indicating either insider knowledge or extensive open-source reconnaissance of the target environment.

ARCHIVE STRUCTURE & STAGE 1 (LNK): The ZIP contained a double-extension LNK file masquerading as a PDF ('常州大学2026年《国家学生体质健康标准》测试通知.pdf.lnk') at the archive root, plus payload files buried four folders deep in nested directories mimicking macOS metadata directory naming conventions to evade automated archive scanning. The LNK abused the legitimate explorer.exe binary to execute the next-stage VBScript — a living-off-the-land (LOtL) technique that avoids spawning wscript.exe or cscript.exe directly, both of which are commonly flagged by EDR solutions.

STAGE 2 (chromedo.vbs): A 1KB VBScript named chromedo.vbs orchestrated both deception and malicious execution simultaneously. It constructed absolute paths to the decoy PDF and the malicious Bandizip executable dynamically at runtime, immediately opened the decoy PDF (capturing the victim's attention with a full-fidelity replica of the official Changzhou University testing notice), waited 800ms for the PDF to render, then silently executed Bandizip.exe via ShellExecute with the 'open' verb and window style 1 — no visible window, no prompt, no user interaction.

STAGE 3 (DLL SIDELOADING — ark.x64.dll): The threat actor abused Bandizip — a legitimate, widely-used South Korean archive management application by Bandisoft — as a LOtL signed binary. A malicious DLL named ark.x64.dll was placed alongside Bandizip.exe in the same hidden directory. Upon execution, Bandizip.exe followed the standard Windows DLL search order and loaded the attacker-controlled ark.x64.dll from its local directory before checking trusted system paths, resulting in malicious code executing under a legitimate process context.

ANTI-ANALYSIS (CreateArk export): The DLL's exported function CreateArk implemented multi-layered evasion: timing-based debugger checks using GetTickCount, CheckRemoteDebuggerPresent, IsDebuggerPresent, and additional analysis evasion routines. The export resolved targeted process names at runtime using memory regions allocated via VirtualAlloc combined with custom decryption loops to keep sensitive strings out of plaintext. The DLL enumerated running processes via CreateToolhelp32Snapshot / Process32First / Process32Next and compared each process name against an internally reconstructed blacklist that included wireshark.exe, procmon.exe, tcpview.exe, dumpcap.exe, fiddler.exe, charles.exe, and additional reverse-engineering and monitoring utilities. If a match was detected, the malware terminated execution to avoid running in monitored or researcher-controlled environments.

STAGE 4 (SFX LOADER & AMSI/ETW BYPASS): After environmental validation, the malware decrypted an obfuscated SFX payload at runtime and dynamically loaded it into process memory without disk persistence. During execution, the unpacked SFX component interacted with Windows security mechanisms — Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) — to disrupt runtime scanning, logging, and telemetry generation, lowering visibility for antivirus and EDR solutions.

STAGE 5 (COBALT STRIKE BEACON): Following the AMSI/ETW bypasses, the SFX payload decrypted the final-stage component entirely in memory, revealing a Cobalt Strike Beacon (SHA256 ed7087e3afba4b320bdf04f32d3a6c567effd3d18a97682968e567000e70b335). The Beacon initialized its User-Agent configuration and attempted to establish C2 communication for outbound network connectivity, executing entirely in memory without an on-disk executable drop to minimize forensic visibility.

C2 INFRASTRUCTURE: The Cobalt Strike Beacon communicated with 60.205.186.162, which resolved to lysander[.]asia, hosted on Alibaba Cloud (AS37963 — Hangzhou Alibaba Advertising), active since 2026-04-06 and still live as of the 2026-05-19 report cutoff. The lysander[.]asia domain was registered through HiChina (万网), an Alibaba Cloud subsidiary serving the Chinese domestic market that requires Chinese identity verification. MX records pointed to Feishu (飞书), ByteDance's enterprise platform predominantly used within China — a significant attribution signal rarely seen in infrastructure operated by non-Chinese actors.

INFRASTRUCTURE PIVOTING: Seqrite identified approximately 20 related Bandizip-themed weaponized samples and additional LNK files sharing common machine IDs across multiple campaigns. All implants beaconed to similar C2 infrastructure registered under AS37963.

ATTRIBUTION (UNG0002 / MEDIUM-HIGH CONFIDENCE): UNG0002 was previously documented in Seqrite's Operation Cobalt Whisper campaign, which heavily leveraged malicious LNK files and obfuscated VBScript as the primary delivery mechanism — identical foundational TTPs to Dragon Whistle. The actor has shifted C2 infrastructure from Tencent Cloud (AS45090, used in Cobalt Whisper) to Alibaba Cloud (AS37963, used in Dragon Whistle) — a deliberate ASN rotation to evade ASN-based blocking. The shift to Mainland China academic targets represents an expansion of UNG0002's footprint beyond previously documented victims.