Also known as: Unknown Group 0002, which has, tracked as, BlackCat, Gookee, kapuchin0, Guki, leaked the source code, shut the operation down, researchers said, Kimsuky, Lazarus, Andariel, Hong Kong, Pakistan, Royal Ransomware
A sophisticated spear-phishing campaign designated Operation Dragon Whistle has been identified targeting Changzhou University in China. The threat actor UNG002 leveraged highly contextual social engineering by impersonating official university communications regarding mandatory 2026 National Student Physical Fitness and Health Standards testing, which directly impacts graduation eligibility. The attack chain begins with a weaponized ZIP file containing a malicious LNK file disguised as a PDF document. Upon execution, it triggers a VBScript that simultaneously displays a legitimate-looking decoy document while deploying a multi-stage infection chain involving DLL sideloading via Bandizip.exe, anti-debugging techniques, and ultimately delivering a Cobalt Strike Beacon payload entirely in memory. The campaign demonstrates advanced evasion capabilities and utilizes Chinese cloud infrastructure hosted on Alibaba Cloud for command and control operations.
Targeted Sectors
Targeted Countries / Regions
Executive Summary
Threat actor UNG002 has been identified as a sophisticated adversary targeting the education sector in China, specifically universities. The actor uses highly contextual spear-phishing campaigns leveraging weaponized ZIP files and malicious scripts to deploy Cobalt Strike Beacon payloads entirely in memory. The campaign demonstrates advanced evasion techniques, including DLL sideloading and anti-debugging methods, while utilizing Chinese cloud infrastructure for command and control.
Goals & Targeting
UNG002's primary objective appears to be compromising educational institutions in China, likely for intelligence gathering or disruptive purposes. The targeting of universities suggests an interest in sensitive data, intellectual property, or the academic community's infrastructure. The use of cloud infrastructure based in China indicates potential ties to state-sponsored activities or adversaries with operational comfort within that region.
Enhanced Description
UNG002 has executed a targeted spear-phishing campaign, designated as Operation Dragon Whistle, against Changzhou University in China. This operation exploits the university's interest in the 2026 National Student Physical Fitness and Health Standards testing by impersonating official communications. The attack vector involves a weaponized ZIP file containing a malicious LNK file disguised as a PDF document. Upon execution, the VBScript狡猾地显示一个看似合法的PDF文件作为分心，同时部署多阶段感染链：通过Bandizip.exe进行DLL侧加载，采用反调试技术，并最终交付Cobalt Strike Beacon有效负载完全在内存中运行。这种技术手法展示了UNG002对高级 evasion capabilities和精确的社会工程学利用能力。此外，该活动的基础设施依赖于中国境内的云服务提供商——阿里巴巴云——用于 command and control operations.
Key Capabilities
MITRE ATT&CK Tactics
ATT&CK Techniques
Software / Tooling
Campaigns & Victims
UNG002's campaign patterns indicate a focus on specific, high-value targets within the education sector. The use of timely and relevant social engineering topics, such as university policies affecting graduation eligibility, suggests a deep understanding of the target environment. Notable operations include Operation Dragon Whistle targeting Changzhou University, demonstrating advanced persistence and evasion techniques.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
Confidence in UNG002's identity and TTPs is high based on observed attack patterns and technical details. However, gaps exist regarding the actor's full range of capabilities, long-term operational history beyond Operation Dragon Whistle, and potential affiliations.
No campaigns linked yet.
No observed data linked yet.
34
Techniques
41
Tools
0
Campaigns
40
IOCs
0
Observed Data
9
Tactics