The threat actor known as Dropping Elephant has resurfaced with a significantly refined and more dangerous campaign, deploying a reworked remote access trojan (RAT) through a Chinaaaa-themed lure document. This latest operation is engineered for stealth, evasion, and complete system compromise, marking a notable evolution in the group’s tradecraft while retaining its core operational signatures.
Campaign Overview: From LNK File to In-Memory RAT
The attack chain begins with a malicious Windows shortcut file named GRES3001.lnk, which is disguised as a PDF document related to an industrial energy contract. When a victim opens this file, it silently executes a PowerShell script that downloads additional malware components from a staging server hosted at chinagreenenergy[.]org. To maintain the illusion of legitimacy, a decoy document concerning a GRES-3 seawater pump contract is displayed to the user while the malicious activity unfolds in the background.
Researchers from Rapid7 identified this campaign during a proactive threat hunt. Their analysis confirmed the activity as a direct evolution of Dropping Elephant’s methods, noting clear overlaps in delivery patterns, screenshot logic, beaconing behavior, and command-handler structure. The researchers were able to download all attack artifacts because the staging server remained active at the time of their analysis.
DLL Side-Loading and Memory-Only Payload Execution
The downloaded files include a legitimate Microsoft binary called Fondue.exe, which is abused for DLL side-loading. This binary loads a malicious file disguised as APPWIZ.cpl. The loader then decrypts an encrypted file named editor.dat and passes the decrypted content to a Donut shellcode loader. This loader maps the final RAT directly into the system’s memory without ever writing it to disk, a technique that effectively bypasses most traditional file-based antivirus and endpoint detection solutions.
Once active, the RAT fingerprints the victim machine and establishes a connection to a command-and-control (C2) server at gcl-power[.]org over encrypted HTTPS traffic on port 443. The malware checks in with the C2 server every 10 seconds and is capable of executing commands, listing files, capturing screenshots, uploading files, and downloading additional tools. This level of access provides the operator with full visibility and control over the infected host.
GoogleErrorReport Scheduled Task for Persistence
After staging all necessary files in the C:\Users\Public\ folder, the PowerShell script creates a scheduled task named GoogleErrorReport. This task is configured to run Fondue.exe every single minute, ensuring the malware restarts automatically and remains active even if the initial process is terminated. The name GoogleErrorReport is deliberately chosen to blend in with normal system activity and avoid raising suspicion from users or security tools.
The script then deletes the original shortcut file, removing the most visible trace of the initial infection. From that point, the scheduled task becomes the sole persistence mechanism, repeatedly triggering the DLL side-loading chain that loads the RAT into memory. Rapid7 noted that defenders should watch for a scheduled task by this exact name running binaries from C:\Users\Public, as it is one of the clearest detection opportunities in this campaign.
Advanced Evasion and Anti-Analysis Capabilities
The final RAT is designed to frustrate security researchers and bypass detection tools. It employs control-flow flattening to scramble its code structure, making static analysis difficult. It also checks for processes tied to debuggers and sandboxes, resolves its API functions at runtime, and patches critical Windows security features—including AMSI (Anti-Malware Scan Interface), WLDP (Windows Lockdown Policy), and ETW (Event Tracing for Windows)—before executing its payload. These layers of evasion make both static and dynamic analysis significantly harder.
Before connecting to its C2 server, the RAT quietly pings google.com, yahoo.com, and cloudflare.com to confirm internet access. It checks the host’s public IP through api.ipify.org and uses ip2c.org to identify the victim’s country. All communication is encrypted with the Salsa20 cipher and wrapped in Base64 encoding, making intercepted traffic very difficult to analyze.
What Defenders Should Focus On
Rapid7 recommends that defenders avoid relying solely on static indicators of compromise (IoCs), as hashes, filenames, and infrastructure are likely to shift across campaigns. Instead, security teams should focus on behavioral signals. Key detection opportunities include shortcut files spawning PowerShell, files staged in the C:\Users\Public\ directory, and any scheduled task named GoogleErrorReport running binaries from outside a legitimate Windows directory.
Endpoint tools should also be reviewed for their ability to detect memory-resident payloads and in-process tampering with security controls like AMSI and ETW. Organizations should prioritize deploying a multi-layer endpoint protection solution that includes behavioral analysis and memory scanning capabilities to defend against this type of fileless attack.
