Operation DRAGONCLONE: Chinese Telecom Targeted by Malware
June 9, 2025, 10:09 a.m.
Description
A sophisticated campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile, has been uncovered. The attack employs VELETRIX, a new loader, and VShell, a known adversary simulation tool. The infection chain begins with a malicious ZIP file containing executable and DLL files. VELETRIX uses anti-analysis techniques, IPFuscation, and a callback mechanism to execute VShell. The campaign shows overlaps with UNC5174 (Uteus) and Earth Lamia, known China-nexus threat actors. The infrastructure utilizes tools like SuperShell, Cobalt Strike, and Asset Lighthouse System. Active since March 2025, this operation demonstrates advanced tactics, techniques, and procedures associated with Chinese state-sponsored threat groups.
Tags
Date
- Created: June 7, 2025, 10:12 a.m.
- Published: June 7, 2025, 10:12 a.m.
- Modified: June 9, 2025, 10:09 a.m.
Additional Informations
- Telecommunications
- China