A fake resume invoked China's defence-tech elite, then installed VShell

This threat involves a Chinese-language executable masquerading as a resume purportedly from a Beijing Institute of Technology graduate student. It delivers SNOWLIGHT and a fileless VShell RAT through a multi-stage infection chain. Initially, a custom Go loader performs sandbox detection, CPU checks, and sleep-timer evasion before downloading a legitimate DOCX file as a decoy. The loader then executes a 1,454-byte SNOWLIGHT stager that connects to attacker infrastructure, downloads 4.65 MB of data, XOR-decodes it with key 0x99, and launches the VShell RAT without writing files to disk. The RAT provides operators with remote command execution, file access, screen capture, and lateral movement capabilities. The lure specifically targets mainland Chinese academics specializing in electrical engineering, power systems, or AI research. The use of panel-generated SNOWLIGHT components common in cracked VShell releases complicates actor attribution, indicating the operator uses commodity tooling focused on China-oriented academic targets.

Successful infection grants attackers remote command execution, file system access, screen capture, and lateral movement within targeted networks. The fileless execution of the VShell RAT complicates detection and removal efforts. Targeting high-value academic personnel in China suggests potential espionage or intellectual property theft. There are no known exploits in the wild or active campaigns confirmed beyond this report.

No official patch or remediation exists as this threat involves social engineering and malware delivery rather than a software vulnerability. Defenders should prioritize user awareness training to identify suspicious attachments, especially those claiming to be resumes from academic sources. Endpoint detection and response solutions should be configured to detect behaviors associated with SNOWLIGHT and VShell RATs, including fileless execution and network connections to known malicious infrastructure. Monitoring and blocking the provided indicators of compromise such as IP addresses, domains, and file hashes is recommended. Since the malware employs sandbox evasion, dynamic analysis environments should be hardened accordingly.