A well-known threat actor called Dropping Elephant has returned with a refined and more dangerous campaign, using a China-themed lure document to drop a reworked remote access trojan (RAT) onto victim machines.
The attack is designed to stay hidden, avoid detection tools, and give the attacker full control over compromised systems. What makes this campaign stand out is how deeply the attackers updated their methods while keeping their recognizable core tradecraft intact.
The campaign starts with a malicious Windows shortcut file named GRES3001.lnk, disguised as a PDF related to an industrial energy contract.
When a victim opens the file, it quietly launches a PowerShell script that downloads additional malware from a staging server at chinagreenenergy[.]org. A decoy document about a GRES-3 seawater pump contract is shown to the victim while the attack continues in the background.
Researchers from Rapid7 identified this campaign during a proactive threat hunt and published a report shared with Cyber Security News (CSN).
Their analysis confirmed this activity as a direct evolution of Dropping Elephant’s tradecraft, noting overlaps in delivery patterns, screenshot logic, beaconing behavior, and command-handler structure.
.webp)
The researchers were also able to download all attack artifacts since the staging server was still active at the time of analysis.
The downloaded files include a legitimate Microsoft binary called Fondue.exe, which is used to side-load a malicious loader disguised as APPWIZ.cpl.
That loader decrypts an encrypted file called editor.dat and passes the result to a Donut shellcode loader, which maps the final RAT directly into memory without writing it to disk. Loading the payload entirely in memory allows the attackers to sidestep most traditional file-based detection methods.
Once active, the RAT fingerprints the victim machine and connects to a command-and-control server at gcl-power[.]org over encrypted HTTPS traffic on port 443.
.webp)
It checks in every 10 seconds and is capable of running commands, listing files, capturing screenshots, uploading files, and downloading additional tools. This level of access gives the operator full visibility and control over the infected host.
After staging all necessary files in the C:\Users\Public\ folder, the PowerShell script creates a scheduled task named GoogleErrorReport.
This task is configured to run Fondue.exe every single minute, ensuring the malware restarts automatically and stays active even if interrupted.
The name GoogleErrorReport is deliberately chosen to blend in with normal system activity and avoid raising suspicion.
.webp){kind=tracking}
The script then deletes the original shortcut file, removing the most visible trace of the initial infection.
From that point, the scheduled task becomes the sole persistence mechanism, repeatedly triggering the DLL side-loading chain that loads the RAT into memory.
Rapid7 noted that defenders should watch for a scheduled task by this exact name running binaries from C:\Users\Public, as it is one of the clearest detection opportunities in this campaign.
The final RAT is designed to frustrate security researchers and bypass detection tools.
It uses control-flow flattening to scramble code structure, checks for processes tied to debuggers and sandboxes, resolves its API functions at runtime, and patches Windows security features including AMSI, WLDP, and ETW before executing its payload.
These layers of evasion make both static and dynamic analysis significantly harder. Before connecting to its C2 server, the RAT quietly pings google.com, yahoo.com, and cloudflare.com to confirm internet access.
It checks the host’s public IP through api.ipify.org and uses ip2c.org to identify the victim’s country. All communication is encrypted with the Salsa20 cipher and wrapped in Base64 encoding, making intercepted traffic very difficult to analyze.
Rapid7 recommends defenders avoid relying solely on IOCs, since hashes, filenames, and infrastructure are likely to shift across campaigns.
.webp)
Instead, teams should focus on behavioral signals such as shortcut files spawning PowerShell, files staged in C:\Users\Public, and any scheduled task named GoogleErrorReport running binaries outside a legitimate Windows directory.
Endpoint tools should also be reviewed for their ability to detect memory-resident payloads and in-process tampering with controls like AMSI and ETW.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| SHA-256 | a8ecbd9c049044ca4990a0e5960d19ce782a3b42d7763e9693d7c91ead24a0b7 | GRES3001.lnk — Initial-access shortcut; launches conhost.exe and PowerShell downloader |
| SHA-256 | 56d656d684077e7b3231393f5464447cdc8eea81b6415c5f010bc52f0c8cb317 | GRES3001.pdf — Decoy lure document |
| SHA-256 | b58351ead08db413ca499cfeb1b1091ed8bfd68f4089605e452fa01ed46f42b1 | Fondue.exe — Legitimate Microsoft side-loading host |
| SHA-256 | 914da75a4ad6d70db856a2bc318d8828f28894622f017ee78d470b4794faafa6 | APPWIZ.cpl — Malicious side-loaded loader; exports RunFODW |
| SHA-256 | 718812adb0d669eea9606432202371e358c7de6cdeafeddad222c36ae0d3f263 | msvcp140.dll — Bundled VC++ runtime; verify against known-good |
| SHA-256 | 09d1e604e8cdd06176fcc3d3698861be20638a4391f9f2d9e23f868c1576ca94 | vcruntime140.dll — Bundled VC++ runtime; verify against known-good |
| SHA-256 | a5e448af73b0ff6b6fcfe6ef7808120e1fd7e5c4c9b4edd68e1c980e5ea3406b | editor.dat — Base64-wrapped AES-256-CBC encrypted payload file |
| SHA-256 | ecab0e747bff16a1163bbd9bb494e68dd4d7ca655ac7279bd4dd73221f7df57c | editor.decrypted.bin — AES-decrypted Donut loader blob |
| SHA-256 | 7099c33933716c00c1f4bdb0281c230b981c76b23d7d1c83abc6f58968267d54 | editor.extracted.exe — Final RAT, carved from memory |
| Domain | chinagreenenergy[.]org | Staging and delivery server |
| Domain | gcl-power[.]org | Operational C2 server over HTTPS/443 |
| Domain | api.ipify.org | Public-IP lookup used during host fingerprinting |
| Domain | ip2c.org | Geolocation lookup used during host fingerprinting |
| URL | https://chinagreenenergy.org/doc/35566/SXxls | Decoy PDF download URL |
| URL | https://chinagreenenergy.org/doc/list/load-list/dfe87bbc-53e0-489f-a9e6-ab8f4be47cb9 | Fondue.exe download URL |
| URL | https://chinagreenenergy.org/doc/list/load-list/8daaa3e4-c85e-40c1-a2a2-94679e94c417 | APPWIZ.cpl download URL |
| URL | https://chinagreenenergy.org/doc/list/load-list/ecdc6b92-62b5-4acd-99f2-af09902938e1 | msvcp140.dll download URL |
| URL | https://chinagreenenergy.org/doc/list/load-list/e7477b17-45f0-420b-b2b1-811d4c1556ea | vcruntime140.dll download URL |
| URL | https://chinagreenenergy.org/doc/list/load-list/000bd4a8-814d-414c-8be8-f0c77a9c7e1e | editor.dat download URL |
| URI Path | /prjozifvkpkfhkr/ | C2 registration and check-in path |
| URI Path | /prjozifvkpkfhkr/gedhagammgjvvva/ | C2 command polling endpoint |
| URI Path | /prjozifvkpkfhkr/spxbjdhxtapivrk/ | Screenshot exfiltration endpoint |
| File Name | GRES3001.lnk | Malicious shortcut disguised as PDF |
| File Name | Fondue.exe | Legitimate binary abused for DLL side-loading |
| File Name | APPWIZ.cpl | Malicious loader dropped in C:\Users\Public\ |
| File Name | editor.dat | Encrypted payload stored in C:\Windows\Tasks\ |
| File Name | GoogleErrorReport | Scheduled task name used for persistence |
| Mutex | kshdkfhskdfjkhsdkfhsjkdfhkj | Mutex created by RAT to prevent reinfection |
| C2 Token | RRn926EmIRfm9IlJyP1yVO2 | 23-character token used in C2 traffic to gcl-power[.]org |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
