Executive Summary
Seqrite Labs has identified a targeted spear-phishing campaign dubbed Operation Dragon Whistle, attributed to the threat actor UNG0002 with medium-high confidence. The campaign specifically targets students and faculty at Changzhou University in China, leveraging a highly contextual lure regarding the mandatory 2026 National Student Physical Fitness and Health Standards testing cycle to create urgency.
The attack chain involves a weaponized ZIP file containing a malicious LNK file that triggers a multi-stage execution process. This includes the use of VBScript to orchestrate the simultaneous opening of a decoy PDF and the execution of a malicious DLL (ark.x64.dll) via side-loading through a legitimate Bandizip executable. The final payload is an in-memory Cobalt Strike Beacon configured to communicate with C2 infrastructure hosted on Alibaba Cloud.
This activity represents a expansion of UNG0002's footprint into Mainland Chinese academia. The threat actor demonstrates high social engineering fidelity by including real institutional details, staff names, and domestic Chinese services like Feishu and HiChina, suggesting a sophisticated operational base within the region.