MalwarePublished 20 May 2026Updated 19 Jun 2026

Operation Dragon Whistle: UNG002 Targets Chinese Academia via Weaponized Institutional Lure

Source AlienVault OTX General

Description

A sophisticated spear-phishing campaign designated Operation Dragon Whistle has been identified targeting Changzhou University in China. The threat actor UNG002 leveraged highly contextual social engineering by impersonating official university communications regarding mandatory 2026 National Student Physical Fitness and Health Standards testing, which directly impacts graduation eligibility. The attack chain begins with a weaponized ZIP file containing a malicious LNK file disguised as a PDF document. Upon execution, it triggers a VBScript that simultaneously displays a legitimate-looking decoy document while deploying a multi-stage infection chain involving DLL sideloading via Bandizip.exe, anti-debugging techniques, and ultimately delivering a Cobalt Strike Beacon payload entirely in memory. The campaign demonstrates advanced evasion capabilities and utilizes Chinese cloud infrastructure hosted on Alibaba Cloud for command and control operations.

Impact

The campaign targets Chinese academic institutions with a spear-phishing lure that could lead to system compromise via a multi-stage malware infection chain. Successful exploitation results in deployment of a Cobalt Strike Beacon payload in memory, enabling potential remote control and further malicious activity. The use of advanced evasion techniques such as DLL sideloading and anti-debugging increases the difficulty of detection and mitigation. However, there are no reports of widespread exploitation or confirmed breaches beyond the identified target.

Defensive guidance

Organizations should be aware of the spear-phishing tactics used and educate users to recognize suspicious emails impersonating official university communications. Since the attack relies on execution of malicious LNK files within ZIP archives, blocking or scrutinizing such attachments and monitoring for execution of unusual processes like Bandizip.exe may help reduce risk. Endpoint detection solutions capable of identifying DLL sideloading and in-memory Cobalt Strike payloads can aid in detection. Given the lack of vendor advisories or patches, continuous monitoring and user awareness remain primary defenses.

Indicators of compromise

Domains 1

lysander.asia

IP addresses 1

60.205.186.162

Hashes 9

902533852b16b6ba322bf33de0e4215e
b5fa57a839f7d63ea8d5d00a9cd5a143777e7da9
35a478f53f64bd412f374c65360fdba0518749537193669a8fe08d14bed65a2a
c937eca7c4c9b98df9257d986e666d25411aac5fa39d21f7018dd2e1663f0c76
cd99e83d241cfbb41bfcd0bc622a87d16268e710ca7d736d0c5f44774e0056e2
e7aff6a55a7866776272d9913dfbf9d7db33fc9de6aced22f2a195feebb0e85f
eb14d9e35a3bf0a933297f861bee0be9e6b9061fe4573a81ac92b71d55b6474f
ed7087e3afba4b320bdf04f32d3a6c567effd3d18a97682968e567000e70b335
fe11b199ada23d5ac25efc4215e67f4ff617ccb4d429eb64412072687367ca1c

Community reviews

Loading reviews…