Executive Summary
UNC5221, a China-nexus threat actor, has been observed deploying the SNOWLIGHT dropper to deliver the VSHELL Remote Access Trojan (RAT). The attack is characterized by a deceptively small 22KB dropper disguised as the 'Windows Update Service' (wusvc.exe). This dropper leverages a high level of technical sophistication to bypass enterprise defenses, including the use of direct syscalls to evade EDR hooks and manual memory manipulation to disable the Antimalware Scan Interface (AMSI).
The malware features a comprehensive suite of anti-analysis capabilities, including checks for debuggers like x64dbg, sandboxes, and security tools. Once established, it maintains a command-and-control (C2) channel via WebSockets, often blending into legitimate CDN traffic from Akamai or Microsoft to mask exfiltration. The modular nature of the payload allows for remote command execution, credential theft, and the deployment of additional modules, posing a significant risk for long-term persistence and lateral movement.