Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile, has been uncovered. The attack employs VELETRIX, a new loader, and VShell, a known adversary simulation tool. The infection chain begins with a malicious ZIP file containing executable and DLL files. VELETRIX uses anti-analysis techniques, IPFuscation, and a callback mechanism to execute VShell. The campaign shows overlaps with UNC5174 (Uteus) and Earth Lamia, known China-nexus threat actors. The infrastructure utilizes tools like SuperShell, Cobalt Strike, and Asset Lighthouse System. Active since March 2025, this operation demonstrates advanced tactics, techniques, and procedures associated with Chinese state-sponsored threat groups.

Operation DRAGONCLONE is a sophisticated cyber espionage campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile. The campaign employs a novel loader named VELETRIX alongside VShell, a known adversary simulation tool, to establish and maintain persistence within the victim environment. The infection vector begins with a malicious ZIP archive containing executable and DLL files, leveraging DLL sideloading techniques to evade detection and execute payloads. VELETRIX incorporates advanced anti-analysis methods and IPFuscation to obscure network communications, complicating detection and attribution efforts. The loader uses a callback mechanism to execute VShell, facilitating further post-exploitation activities. The campaign infrastructure includes tools such as SuperShell, Cobalt Strike, and the Asset Lighthouse System, indicating a high level of operational sophistication and resource availability. Attribution links this operation to China-nexus threat actors, specifically UNC5174 (Uteus) and Earth Lamia, groups known for targeting telecommunications and critical infrastructure sectors. The campaign has been active since March 2025, demonstrating ongoing efforts to compromise strategic telecom assets. The attack chain aligns with multiple MITRE ATT&CK techniques including user execution (T1204.002), DLL sideloading (T1574.001), credential dumping (T1003), and network reconnaissance (T1046), among others. Despite the presence of CVE-2024-1709 and CVE-2025-31324 references, no known exploits in the wild have been reported, suggesting the campaign relies on custom tooling and targeted delivery rather than widespread exploitation. Overall, Operation DRAGONCLONE exemplifies a targeted, state-sponsored espionage effort leveraging advanced malware and evasion techniques to infiltrate and persist within a major Chinese telecom entity.

Detailed information about Operation DRAGONCLONE: Chinese Telecom Targeted by Malware. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'earth lamia'

Filter Threats

Threats Tagged 'earth lamia'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility