Fake Student Resume Campaign Delivers SNOWLIGHT and VShell RATs to Researchers
A sophisticated phishing campaign is targeting academic researchers with a fake student resume designed to deliver the SNOWLIGHT and VShell remote-access trojans.
Researchers are being targeted by a new campaign that employs a deceptive tactic: a fake student resume delivered via a malicious archive. This campaign aims to install the SNOWLIGHT and VShell remote-access trojans (RATs) on the computers of individuals involved in academic research, particularly in fields like electrical engineering, energy systems, and applied artificial intelligence. The lure is crafted to appear as a genuine graduate school application from a Beijing Institute of Technology graduate seeking research opportunities, making it highly convincing to professors and laboratory staff.
The attack chain begins with a ZIP archive that contains a Windows executable disguised with a document-like name, relying on Windows' default behavior of hiding file extensions. Upon execution, the loader presents a legitimate-looking DOCX resume, creating a plausible cover for the malicious activity occurring in the background. This decoy document details fictional research on AI-based power-grid fault diagnosis and renewable-energy control, further tailoring the bait to academic recipients.
While the victim is engaged with the decoy resume, the malware initiates a fileless, memory-based execution chain. The loader performs checks, including verifying the system has at least four CPU cores and employing a timing test, before proceeding. This multi-stage process is designed to evade traditional disk-based security measures, as the initial payload is executed directly in memory without writing conventional files to the system.
The SNOWLIGHT shellcode, once loaded into memory, contacts a command-and-control (C2) server. After a brief system check-in, it receives an encrypted payload. This payload is then decoded, and execution is transferred to the VShell RAT. VShell subsequently registers itself with the same C2 server using encrypted traffic, establishing a remote-access foothold for the attackers.
VShell is a versatile RAT capable of providing an interactive command shell, file transfer capabilities, screen capture, network discovery, and tunneling. While VShell has been observed in various threat actor activities, its presence in this campaign, coupled with SNOWLIGHT, does not definitively attribute the attack to a specific known group. The report suggests an unattributed actor is behind this operation, leveraging readily available tools and a targeted social engineering approach.
The campaign's focus on academic institutions and the specific technical fields mentioned in the resume suggest a motive related to intellectual property theft, espionage, or disruption of research activities. The use of a mainland Chinese academic context for the lure, while not confirming state sponsorship, indicates a potential regional focus for the threat actor.
To mitigate this threat, researchers and IT departments are advised to exercise extreme caution with unsolicited applications, especially those containing executables within archives. Enabling visible file extensions, blocking executable content in unexpected archives, and monitoring for unusual process and network activity are crucial steps. Verifying the legitimacy of applications through separate contact channels before opening any files is paramount.
This new article details a specific campaign targeting academic researchers with a fake student resume containing a Windows executable. The executable deploys the SNOWLIGHT backdoor and VShell remote-access trojan via a fileless, memory-based chain. The lure is tailored for technical academics, using a believable application context to deliver the malware, highlighting the need for caution even in academic correspondence.