Operation Dragon Whistle is a sophisticated spear-phishing campaign attributed to the threat actor UNG002 targeting Changzhou University in China. It employs highly contextual social engineering by impersonating official university communications related to mandatory 2026 National Student Physical Fitness and Health Standards testing. The attack vector is a weaponized ZIP file containing a malicious LNK file disguised as a PDF document. Execution of the LNK triggers a VBScript that displays a decoy document while initiating a multi-stage infection chain involving DLL sideloading through Bandizip.exe, anti-debugging techniques, and ultimately delivering a Cobalt Strike Beacon payload executed entirely in memory. The campaign leverages Chinese cloud infrastructure hosted on Alibaba Cloud for command and control operations. Indicators include multiple file hashes, an IP address, and a domain associated with the campaign. There is no CVE or patch information available, and no known exploits in the wild have been reported.

The campaign targets Chinese academic institutions with a spear-phishing lure that could lead to system compromise via a multi-stage malware infection chain. Successful exploitation results in deployment of a Cobalt Strike Beacon payload in memory, enabling potential remote control and further malicious activity. The use of advanced evasion techniques such as DLL sideloading and anti-debugging increases the difficulty of detection and mitigation. However, there are no reports of widespread exploitation or confirmed breaches beyond the identified target.

No official patch or remediation guidance is provided for this campaign. Organizations should be aware of the spear-phishing tactics used and educate users to recognize suspicious emails impersonating official university communications. Since the attack relies on execution of malicious LNK files within ZIP archives, blocking or scrutinizing such attachments and monitoring for execution of unusual processes like Bandizip.exe may help reduce risk. Endpoint detection solutions capable of identifying DLL sideloading and in-memory Cobalt Strike payloads can aid in detection. Given the lack of vendor advisories or patches, continuous monitoring and user awareness remain primary defenses.