Classification: TLP:WHITE | Intelligence Category: APT & Nation-State Campaign Intelligence | Analysis Date: 2026-09-27
Threat Summary
A single, high-fidelity OTX pulse documents a socially engineered intrusion chain aimed squarely at China's defense-technology talent pipeline. The campaign delivers a Chinese-language executable masquerading as a resume from a graduate student at the Beijing Institute of Technology (BIT) — an institution with deep ties to China's defense-industrial complex. When executed, the lure deploys the SNOWLIGHT stager, which in turn retrieves and installs the VShell remote access trojan.
The tradecraft is deliberate and patient: a custom Go loader performs sandbox detection, CPU topology checks, and sleep-timer evasion before committing to execution. Only after passing these gates does it fetch a legitimate DOCX decoy document — shown to the victim to preserve the illusion — while a compact 1,454-byte SNOWLIGHT stager establishes outbound connectivity and pulls down the full VShell payload (approximately 4.65 MB). The choice of an academic lure, Mandarin-language social engineering, and defense-adjacent institutional branding strongly suggests an espionage-motivated operator targeting researchers, faculty, and administrative staff connected to sensitive research programs. Attribution remains unknown, but the infrastructure discipline and evasion investment are consistent with mature, well-resourced intrusion sets rather than commodity crimeware.
Threat Actor / Malware Profile
Attribution: Unknown (cluster under tracking; behavioral overlap with China-nexus espionage tooling ecosystems)
SNOWLIGHT (Loader / Stager)
- Distribution method: Malicious executable disguised as a resume (Mandarin filename), delivered via targeted email or file-sharing lures referencing BIT graduate applications.
- Payload behavior: Acts as a first-stage downloader. The stager itself is exceptionally small (~1.4 KB), consistent with a design philosophy of minimal on-disk footprint and fileless follow-on execution.
- Anti-analysis techniques: The wrapper Go loader implements sandbox/environment detection, CPU core and topology validation (to filter out analysis VMs), and extended sleep timers to outlast automated detonation windows. Only after checks pass does it retrieve a benign DOCX decoy to maintain victim trust.
- Execution style: Fileless execution of downstream stages; the tagged
go loaderandfileless executiontradecraft reduces signature surface for endpoint tools keyed on static artifacts.
VShell (Remote Access Trojan)
- Payload behavior: Full-featured RAT delivered as the second stage (~4.65 MB). VShell provides remote command execution, file management, and operator-interactive access, and is commonly observed in intrusions with intelligence-collection objectives.
- C2 communication: Establishes outbound sessions to operator-controlled infrastructure staged by SNOWLIGHT. C2 details should be pivoted from the pulse's full 15-indicator set and the referenced technical write-up.
- Persistence mechanism: Persistence is operator-dependent but RATs of this class typically anchor via Run keys, scheduled tasks, or service registration post-exploitation; hunt accordingly.
IOC Analysis
The pulse carries 15 indicators; the exposed sample is composed entirely of file hashes (7× SHA256, 1× MD5 shown), covering the lure executable, Go loader, SNOWLIGHT stager, DOCX decoy, and VShell payload across observed variants.
Operationalization guidance for SOC teams:
- File hashes (SHA256/MD5): Push the full SHA256 set into EDR blocklists, email gateway detonation verdicts, and proxy/secure web gateway custom block policies. Hashes are brittle — treat them as retrospective hunt keys and blocking controls, not forward-looking detection.
- Pivoting: Hashes should be enriched through VirusTotal/OTX pivoting to extract the imphash (Go binaries), compile timestamps, and — critically — the C2 infrastructure referenced in the linked analysis. The network IOCs are your durable detection surface; the file hashes are your cleanup surface.
- Tooling: Use OTX DirectConnect API integrations to sync this pulse into your SIEM/TIP automatically. Go binaries respond well to
yarawith Go-aware rules,goresymfor symbol recovery, andpeframe/flossfor string extraction on the stager. - Watch for variant drift: Go loaders recompile trivially. Behavior-based detections (below) will outlive this hash set.
Detection Engineering
The following Sigma detections target the resume-lure execution pattern, the decoy-document trust mechanism, and SNOWLIGHT's outbound staging behavior.
YAML
---
title: Suspicious Resume-Themed Executable Launched by User
id: 7d2a9f41-3b6e-4c8a-9f0d-5e1a2b3c4d01
status: experimental
description: Detects execution of resume/CV-themed executables (including Chinese-language lures) from user-writable directories, consistent with the SNOWLIGHT/VShell fake-resume campaign.
author: Security Arsenal Threat Intelligence
logsource:
category: process_creation
product: windows
detection:
selection_image:
Image|endswith: '.exe'
selection_name:
Image|contains:
- 'resume'
- 'cv'
- '简历'
- '求职'
- '履历'
selection_path:
Image|contains:
- '\Downloads\'
- '\Desktop\'
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
condition: selection_image and selection_name and selection_path
falsepositives:
- Legitimate job application tools packaged as executables (rare)
level: high
tags:
- attack.initial_access
- attack.t1204.002
- attack.t1566
---
title: Office Application Spawned by Non-Office Executable - Decoy Document Pattern
id: 8e3b0a52-4c7f-5d9b-0a1e-6f2b3c4d5e02
status: experimental
description: Detects winword.exe launched by an unsigned executable in a user directory, matching the SNOWLIGHT loader behavior of opening a legitimate DOCX decoy after payload staging.
author: Security Arsenal Threat Intelligence
logsource:
category: process_creation
product: windows
detection:
selection_image:
Image|endswith: '\winword.exe'
selection_parent:
ParentImage|contains:
- '\Downloads\'
- '\Desktop\'
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
filter_explorer:
ParentImage|endswith: '\explorer.exe'
condition: selection_image and selection_parent and not filter_explorer
falsepositives:
- Custom document-management utilities opening Word files
level: medium
tags:
- attack.defense_evasion
- attack.t1036
- attack.t1204
---
title: Unsigned Binary in User Directory Initiating Outbound Connection - SNOWLIGHT Staging
id: 9f4c1b63-5d8a-6e0c-1b2f-7a3c4d5e6f03
status: experimental
description: Detects unsigned executables running from user-writable paths establishing outbound network connections, consistent with the SNOWLIGHT stager contacting C2 to download the VShell payload.
author: Security Arsenal Threat Intelligence
logsource:
category: network_connection
product: windows
detection:
selection:
Image|contains:
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
- '\Downloads\'
Initiated: 'true'
filter_common:
DestinationPort:
- 80
- 443
DestinationIp|cidr:
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
condition: selection and not filter_common
falsepositives:
- Portable applications and self-updating tools running from AppData
level: high
tags:
- attack.command_and_control
- attack.t1071
- attack.t1105
The following Sentinel hunt query correlates process lineage, unsigned user-directory binaries, and outbound connections, and matches file events against the pulse hash set.
KQL — Microsoft Sentinel / Defender
// SNOWLIGHT / VShell hunt: IOC hash match + behavioral staging chain
let IocHashes = dynamic([
"c25d4412f7f93e7de5b2aaf41747175d94cffd983ca20efbd0efcdd718b58c4d",
"81c51138d5527ca7dcc258171eb36659c479f66c86a8947b6340d040b3860a30",
"f6d4da5afc89bf9e536a9002c4d256c696df2389d77279f4c5daf6979557e74e",
"0524619d2471d77aba4b7993f5ffbaa4b8be6d2c0d91e63a02943851dc4b6404",
"ed2eaa6ef3eda95383b6efc35b88acbca742ad7bd118931f74727a3139ff7e97",
"c666ac4f1a1b8df7ccfe8b19705279acd8b7eb7a4d0b3802bb3465064883ab25",
"de3f56d0d5b71f2a1a1905f0b01b84fbab237e9d4c5179a05b127d806823f83c"
]);
let HashHits =
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where SHA256 in (IocHashes) or MD5 == "a7cc7e3cdd2f0f9210044911a483fa5d"
| project HashHitTime=TimeGenerated, DeviceName, FolderPath, FileName, SHA256;
let StagingChain =
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("\\Downloads\\", "\\Desktop\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\")
| where FileName endswith ".exe"
| join kind=inner (
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl !isempty or RemoteIP !startswith "10." and RemoteIP !startswith "192.168."
| project DeviceName, InitiatingProcessId=ProcessId, RemoteIP, RemoteUrl, RemotePort, NetTime=TimeGenerated
) on DeviceName, ProcessId == InitiatingProcessId
| project DeviceName, FileName, FolderPath, ProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, NetTime;
union HashHits, StagingChain
| sort by DeviceName asc
The following PowerShell script hunts endpoints for the pulse IOC hashes, unsigned user-directory processes with live connections, and common VShell persistence anchors.
PowerShell
# Security Arsenal - SNOWLIGHT/VShell Endpoint Hunt Script
$iocHashes = @(
'c25d4412f7f93e7de5b2aaf41747175d94cffd983ca20efbd0efcdd718b58c4d',
'81c51138d5527ca7dcc258171eb36659c479f66c86a8947b6340d040b3860a30',
'f6d4da5afc89bf9e536a9002c4d256c696df2389d77279f4c5daf6979557e74e',
'0524619d2471d77aba4b7993f5ffbaa4b8be6d2c0d91e63a02943851dc4b6404',
'ed2eaa6ef3eda95383b6efc35b88acbca742ad7bd118931f74727a3139ff7e97',
'c666ac4f1a1b8df7ccfe8b19705279acd8b7eb7a4d0b3802bb3465064883ab25',
'de3f56d0d5b71f2a1a1905f0b01b84fbab237e9d4c5179a05b127d806823f83c'
)
$iocMd5 = 'a7cc7e3cdd2f0f9210044911a483fa5d'
$searchPaths = @("$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop", "$env:TEMP", "$env:APPDATA")
Write-Output '=== [1] File hash sweep in user-writable directories ==='
foreach ($path in $searchPaths) {
if (Test-Path $path) {
Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
try {
$sha = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
if ($iocHashes -contains $sha) {
Write-Output "[IOC MATCH] $($_.FullName) SHA256=$sha"
}
} catch {}
}
}
}
Write-Output '=== [2] Running processes from user directories with network connections ==='
$netConns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($conn in $netConns) {
$proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
if ($proc -and $proc.Path -and ($proc.Path -match 'AppData|Downloads|Temp')) {
$sig = Get-AuthenticodeSignature -FilePath $proc.Path -ErrorAction SilentlyContinue
if ($sig.Status -ne 'Valid') {
Write-Output "[SUSPICIOUS] PID=$($proc.Id) Path=$($proc.Path) Remote=$($conn.RemoteAddress):$($conn.RemotePort) Signed=$($sig.Status)"
}
}
}
Write-Output '=== [3] Persistence anchor review (Run keys + recent scheduled tasks) ==='
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
Get-ItemProperty -Path $key -ErrorAction SilentlyContinue | ForEach-Object {
$_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|Temp' -and $_.Name -notmatch '^PS' } | ForEach-Object {
Write-Output "[PERSISTENCE] $key :: $($_.Name) = $($_.Value)"
}
}
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.Actions.Execute -match 'AppData|Temp' } | ForEach-Object {
Write-Output "[TASK] $($_.TaskName) -> $($_.Actions.Execute)"
}
Write-Output '=== Hunt complete. Escalate any [IOC MATCH] or [SUSPICIOUS] findings to IR immediately. ==='
Response Priorities
Immediate (0–4 hours)
- Push all pulse SHA256/MD5 indicators into EDR block policy, email gateway, and web proxy custom block lists.
- Execute the KQL hunt and PowerShell sweep across endpoints, prioritizing users in research, engineering, HR, and academic-affairs functions who would plausibly receive resume-themed lures.
- Quarantine any host with an IOC hash match; capture memory before remediation given the fileless execution tradecraft — disk-only forensics will miss the VShell stage.
- Pivot the hashes through OTX/VirusTotal to extract the SNOWLIGHT C2 infrastructure; block resolved domains/IPs at the egress proxy and DNS layer.
24 Hours
- Review authentication logs for any user on an affected host: VShell provides interactive access, so treat exposed sessions as fully compromised. Force credential resets and revoke active tokens/sessions for impacted accounts.
- Audit mailbox rules and forwarding on accounts that received the lure — espionage operators frequently establish collection persistence at the mail layer.
- Deploy the Sigma rules above to production SIEM with tuning exclusions for legitimate portable applications.
1 Week
- Harden the execution surface: enforce application control (WDAC/AppLocker) to block unsigned binaries executing from
Downloads,Desktop,Temp, andRoaming— this single control breaks the entire observed chain. - Configure attachment policy to strip or sandbox detonate executable content regardless of extension or language, with extended detonation timeouts (5+ minutes) to defeat the loader's sleep-timer evasion.
- Brief targeted user populations (research faculty, HR, admissions) on resume-lure social engineering with Mandarin-language examples from this campaign.
- Establish an OTX DirectConnect feed into the TIP so future pulses in this cluster auto-populate hunt queues.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.