Executive Summary
A threat actor designated as UNG0002 has been observed conducting a campaign known as Operation Cobalt Whisper, specifically targeting Changzhou University in China. The attack utilizes a novel filesystem evasion technique where malicious payloads are nested within four layers of directories mimicking macOS metadata (e.g., .Trash, .Spotlight-V100). This approach exploits the behavior of Windows security tools that typically skip these paths to avoid cross-platform scanning overhead, allowing the malicious LNK file to remain undetected.
The infection chain is highly sophisticated, utilizing spear-phishing lures themed around national student fitness standards to increase legitimacy. Upon execution, the malware employs DLL sideloading of the Bandizip utility to execute Cobalt Strike Beacon entirely in memory. The campaign incorporates multiple evasion techniques, including AMSI and ETW bypasses, to eliminate forensic telemetry and prevent detection by modern EDR and antivirus solutions.
This activity highlights the persistent risk to the education and research sectors, which serve as high-value targets for intellectual property and dual-use technology data. The use of cloud infrastructure like Alibaba Cloud for C2 traffic suggests an actor familiar with regional Chinese infrastructure and academic cycles.