VTPRACTITIONERS{SEQRITE}: Tracking UNG0002, Silent Lynx and DragonClone ~ VirusTotal Blog Popular Posts An update from VirusTotal Our goal is simple: to help keep you safe on the web. And we’ve worked hard to ensure that the services we offer continually improve. But as... From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized The fastest-growing personal AI agent ecosystem just became a new delivery channel for malware. Over the last few days, VirusTotal has detec... VTPRACTITIONERS{ACRONIS}: Tracking FileFix, Shadow Vector, and SideWinder Introduction We have recently started a new blog series called #VTPRACTITIONERS. This series aims to share with the community what other pr... Blog Archive ►  2026 (5) ►  June 2026 (1) ►  April 2026 (1) ►  February 2026 (2) ►  January 2026 (1) ▼  2025 (17) ►  December 2025 (1) ►  November 2025 (3) ▼  October 2025 (4) Hugging Face and VirusTotal: Building Trust in AI ... VTPRACTITIONERS{SEQRITE}: Tracking UNG0002, Silen... Simpler Access for a Stronger VirusTotal Crowdsourced AI += Exodia Labs ►  September 2025 (3) ►  August 2025 (3) ►  June 2025 (2) ►  January 2025 (1) ►  2024 (18) ►  November 2024 (1) ►  October 2024 (1) ►  September 2024 (1) ►  August 2024 (2) ►  May 2024 (5) ►  April 2024 (2) ►  March 2024 (2) ►  February 2024 (2) ►  January 2024 (2) ►  2023 (35) ►  December 2023 (5) ►  November 2023 (3) ►  October 2023 (2) ►  September 2023 (1) ►  August 2023 (2) ►  July 2023 (5) ►  June 2023 (5) ►  May 2023 (3) ►  April 2023 (3) ►  March 2023 (2) ►  February 2023 (2) ►  January 2023 (2) ►  2022 (23) ►  December 2022 (1) ►  November 2022 (6) ►  October 2022 (1) ►  September 2022 (1) ►  August 2022 (3) ►  July 2022 (1) ►  May 2022 (1) ►  April 2022 (2) ►  March 2022 (3) ►  February 2022 (2) ►  January 2022 (2) ►  2021 (19) ►  December 2021 (2) ►  November 2021 (4) ►  October 2021 (3) ►  September 2021 (2) ►  August 2021 (2) ►  July 2021 (1) ►  May 2021 (2) ►  March 2021 (1) ►  February 2021 (1) ►  January 2021 (1) ►  2020 (15) ►  December 2020 (2) ►  November 2020 (3) ►  October 2020 (2) ►  August 2020 (1) ►  June 2020 (1) ►  May 2020 (1) ►  February 2020 (3) ►  January 2020 (2) ►  2019 (19) ►  November 2019 (2) ►  October 2019 (4) ►  July 2019 (1) ►  June 2019 (2) ►  May 2019 (3) ►  April 2019 (1) ►  March 2019 (2) ►  February 2019 (2) ►  January 2019 (2) ►  2018 (10) ►  December 2018 (1) ►  November 2018 (1) ►  June 2018 (1) ►  May 2018 (1) ►  April 2018 (3) ►  March 2018 (1) ►  January 2018 (2) ►  2017 (13) ►  November 2017 (1) ►  October 2017 (2) ►  September 2017 (1) ►  August 2017 (1) ►  July 2017 (2) ►  March 2017 (4) ►  February 2017 (2) ►  2016 (6) ►  November 2016 (2) ►  August 2016 (2) ►  May 2016 (1) ►  January 2016 (1) ►  2015 (8) ►  November 2015 (1) ►  October 2015 (1) ►  June 2015 (2) ►  April 2015 (1) ►  February 2015 (1) ►  January 2015 (2) ►  2014 (24) ►  December 2014 (1) ►  November 2014 (3) ►  October 2014 (1) ►  September 2014 (1) ►  July 2014 (6) ►  June 2014 (4) ►  May 2014 (4) ►  February 2014 (3) ►  January 2014 (1) ►  2013 (26) ►  November 2013 (2) ►  October 2013 (7) ►  September 2013 (4) ►  June 2013 (1) ►  May 2013 (2) ►  April 2013 (5) ►  March 2013 (2) ►  February 2013 (2) ►  January 2013 (1) ►  2012 (26) ►  December 2012 (1) ►  November 2012 (4) ►  October 2012 (2) ►  September 2012 (3) ►  August 2012 (2) ►  July 2012 (2) ►  June 2012 (6) ►  May 2012 (2) ►  April 2012 (2) ►  March 2012 (1) ►  February 2012 (1) ►  2011 (1) ►  December 2011 (1) Twitter Github YouTube Search Widgets Connect Search Tuesday, October 21, 2025 APT , malware , success stories , threat hunting , threat intelligence , VirusTotal VTPRACTITIONERS{SEQRITE}: Tracking UNG0002, Silent Lynx and DragonClone Tuesday, October 21, 2025 Joseliyo Sánchez Leave a comment Introduction One of the best parts of being at VirusTotal (VT) is seeing all the amazing ways our community uses our tools to hunt down threats . We love hearing about your successes, and we think the rest of the community would too. That's why we're so excited to start a new blog series where we'll be sharing success stories from some of our customers . They'll be giving us a behind-the-scenes look at how they pivot from an initial clue to uncover entire campaigns. To kick things off, we're thrilled to have our friends from SEQRITE join us. Their APT-Team is full of incredible threat hunters, and they've got a great story to share about how they've used VT to track some sophisticated actors. How VT plays a role in hunting for analysts For a threat analyst, the hunt often begins with a single, seemingly isolated clue—a suspicious file, a strange domain, or an odd IP address. The challenge is to connect that one piece of the puzzle to the larger picture. This is where VT truly shines. VT is more than just a tool for checking if a file is malicious. It's a massive, living database of digital artifacts (process activity, registry key activity, memory dumps, LLM verdicts, among others) and their relationships. It allows analysts to pivot from one indicator of compromise to another, uncovering hidden connections and mapping out entire attack campaigns. It's this ability to connect the dots—to see how a piece of malware communicates with a C2 server, what other files are associated with it, what processes were launched or files were used to set persistence or exfiltrate information, and who else has seen it—that transforms a simple file check into a full-blown investigation. The following story from SEQRITE is a perfect example of this process in action. Seqrite - Success Story [In the words of SEQRITE…] We at SEQRITE APT-Team perform a lot of activities, including threat hunting and threat intelligence, using customer telemetry and multiple other data corpuses. Without an iota of doubt, apart from our customer telemetry, the VT corpus has aided us a decent amount in converting our research, which includes hunting unique campaigns and multiple pivots that have led us to an interesting set of campaigns, ranging across multiple spheres of Asian geography, including Central, South, and East Asia. UNG0002 SEQRITE APT-Team have been tracking a south-east asian threat entity, which was termed as UNG0002 , using certain behavioral artefacts, such using similar OPSEC mistakes across multiple campaigns and using similar set of decoys and post-exploitation toolkit across multiple operational campaigns ranging from May 2024 to May 2025. During the initial phase of this campaign, the threat actor performed multiple targets across Hong Kong and Pakistan against sectors involving defence, electrotechnical, medical science, academia and much more. VT corpus has helped us to pivot through Cobalt Strike oriented beacons , which were used by this threat actor to target various sectors. In our hunt for malicious activity, we discovered a series of Cobalt Strike beacons. These were all delivered through similar ZIP files, which acted as lures. Each ZIP archive contained the same set of file types: a malicious executable, along with LNK, VBS, and PDF decoy files. The beacons themselves were also similar, sharing configurations, filenames and compilation timestamps. Using the timestamps from the malicious executables and the filenames previously mentioned, we discovered up to 14 different samples , all of them related to the campaign with this query VirusTotal query: metadata:"2015:07:10 03:27:31+00:00" filename:"imebroker.exe" based on the configuration extracted by VT, we could use the public key extracted to identify more samples using exactly the same with the following query malware_config:30819f300d06092a864886f70d010101050003818d003081890281810096cc4e6ad9aee91ca69b7b44465e17412626a11c7855b7a69daad00f48c0ea98f0e389a0a1c4b74332bf0d603a6e53e05ee734c9a289ff172204bfc9430ed4d6041402d02b526e902b95f6f219598cb1b6391403fa627ab36dbe88646620369e7ec89bdc31f1a2b0bedba1852d5e7656d3b297f9d39f357816f0677563bc496b020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Besides these executables, we mentioned that there were also LNK files within the ZIP files. After analyzing them, a consistent LNK-ID metadata revealed the same identifiers across many samples. Querying VT for those LNK-IDs exposed we could identify new files related to the campaign. VirusTotal query: metadata:"laptop-g5qalv96" Decoy documents identified within the ZIP files mentioned above We initially tracked several campaigns leveraging LNK-based device IDs and Cobalt Strike beacons. However, an intriguing shift began to emerge in the September-October activity. We observed a new set of campaigns that frequently used CV-themed decoys , often impersonating students from prominent Chinese research institutions. While the spear-phishing tactics remained similar, the final execution changed. The threat actors dropped their Cobalt Strike beacons and pivoted toward DLL-Sideloading for their payloads, all while keeping the same decoy theme. This significant change in technique led us to identify a second major wave of this activity, which we're officially labeling Operation AmberMist. Tracking this second wave of operations attributed to the UNG0002 cluster, we observed a recurring behavioral artifact: the use of academia-themed lures targeting victims in China and Hong Kong. Across these campaigns, multiple queries were leveraged, but a consistent pattern emerged—heavy reliance on LOLBINS such as wscript.exe , cscript.exe , and VBScripts for persistence. By developing a simple yet effective hunting query , we were able to uncover a previously unseen sample not publicly reported: type:zip AND (metadata:"lnk" AND metadata:".vbs" AND metadata:".pdf") and submitter:HK VirusTotal query: type:zip AND (metadata:"lnk" AND metadata:".vbs" AND metadata:".pdf") and submitter:HK Silent Lynx Another campaign tracked by the SEQRITE APT-team, named Silent Lynx , targeted multiple sectors including banking . As in the previous described case, thanks to VT we were able to pivot and identify new samples associated with this campaign. Initial Discovery and Pivoting During the initial phase of this campaign, we discovered a decoy-based SPECA-related archive file targeting Kyrgyzstan around December 2024 - January 2025. The decoy was designed to distract from the real payload: a malicious C++ implant. Decoy document identified during our research Email identified during our reserach We performed multiple pivots focusing on the implant, starting by analyzing the sample’s metadata and network indicators and functionalities, we found that the threat actor had been using a similar C++ implant, which led us to another campaign targeting the banking sector of Kyrgyzstan related to Silent Lynx too. Information obtained during the analysis of the C++ implants Information obtained during the analysis of the C++ implants We leveraged VT corpus for deploying multiple Livehunt rules on multiple junctures, some of the simpler examples are as follows: Looking at the usage of encoded Telegram Bot based payload inside the C++ implant. Using either content or malware_config modifiers when extracted from the config could help us to identify new samples. Spawning Powershell.exe LOLBIN. VT search enablers for checking for malicious email files, if uploaded from Central Asian Geosphere. ISO-oriented first-stagers. Multiple behavioral overlaps between YoroTrooper & Silent Lynx and further hunting hypothesis developed by us.  Leveraging VT corpus and using further pivots on the above metrics and many others included on the malicious spear-phishing email, we also tracked some further campaigns. Most importantly, we developed a new YARA rule and a new hypothesis every time to hunt for similar implants leveraging the Livehunt feature depending on the tailored specifications and the raw data we received during hunting keeping in mind the cases of false positives and false negatives. Decoy document identified during our hunting activities Submissions identified in the decoy document The threat actor repeatedly used the same implant across multiple campaigns in Uzbekistan and Turkmenistan . Using hunting queries through VT along with submitter:UZ or submitter:TM helped us to identify these samples. The most important pivot in our investigation was the malware sample itself as shown in the previous screenshots was the usage of encoded PowerShell blob spawning powershell.exe , which was used multiple times across different campaigns. This sample acted as a key indicator, allowing us to uncover other campaigns targeting critical sectors in the region, and confirmed the repetitive nature of the actor's operations. Also, thanks to VT feature of collections , we further leveraged it to build an attribution of the threat entity. Collections used during the attribution process DragonClone Finally, the last campaign that we wanted to illustrate how pivoting within the VT ecosystem enabled our team to uncover new samples was by a group we named DRAGONCLONE The SEQRITE APT Team has been monitoring DRAGONCLONE as they actively target critical sectors across Asia and the globe. They utilize sophisticated methods for cyber-espionage, compromising strategic organizations in sectors like telecom and energy through the deployment of custom malware implants, the exploitation of unpatched vulnerabilities, and extensive spear-phishing. Initial Discovery Recently, on 13th May , our team discovered a malicious ZIP file that surfaced across various sources, including VT. The ZIP file was used as a preliminary infection vector and contained multiple EXE and DLL files inside the archive, like this one which contains the malicious payload. Chinese-based threat actors have a well-known tendency to deliver DLL sideloading implants as part of their infection chains. Leveraging crowdsourced Sigma rules in VT , along with personal hunting techniques using static YARA signatures , we were able to track and hunt this malicious spear-phishing attachment effectively. In their public Sigma Rules list you can find different Sigma Rules that are created to identify DLL SideLoading. Pivoting Certificates via VT Corpus While exploring the network of related artifacts, we could not initially find any direct commonalities. However, a particular clean-looking executable named “2025 China Mobile Tietong Co., Ltd. Internal Training Program” raised our concern. Its naming and metadata suggested potential masquerading behavior, making it a critical pivot point that required deeper investigation. Certificates are one of the most key indicators, while looking into malicious artefacts, we saw that it is a fresh and clean copy of WonderShare’s Repairit Software, a well known software for repairing corrupted files, whereas a suspicious concern is that it has been signed by ShenZhen Thunder NetWorking Technologies Ltd VirusTotal query: signature:"ShenZhen Thunder Networking Technologies Ltd." Using this hunch, we discovered and hunted for executables , which have been signed by similar and found there have been multiple malicious binaries, although, this has not been the only indicator or pivot, but a key one, to research for further ones. Pivoting on Malware Configs via VT Corpus We analyzed the loader and determined it's slightly advanced , performing complex tasks like anti-debugging. More significantly, it drops V-Shell, a post-exploitation toolkit. V-Shell was originally open-source but later taken down by its authors and has been observed in campaigns by Earth Lamia. After extracting the V-Shell shellcode, we discovered an unusual malware configuration property: qwe123qwe . By leveraging the VT corpus to pivot on this finding, we were able to identify additional V-Shell implant samples potentially linked to this campaign. VirusTotal query: malware_config:"qwe123qwe" VT Tips (based on the success story) [In the words of VirusTotal…] Threat hunting is an art , and a good artist needs the right tools and techniques. In this section, we'll share some practical tips for pivoting and hunting within the VirusTotal ecosystem , inspired by the techniques used in the campaigns discussed in this blog post. Hunt by Malware Configuration Many malware families use configuration files to store C2 information, encryption keys, and other operational data. For some malware families, VirusTotal automatically extracts these configurations. You can use unique values from these configurations to find other samples from the same campaign. For instance, in the DRAGONCLONE investigation, the V-Shell implant had an unusual malware configuration property: qwe123qwe . A simple query like malware_config:"qwe123qwe" in VT can reveal other samples using the same configuration . Similarly, the Cobalt Strike beacons used by UNG0002 had a unique public key in their configuration that could be used for pivoting. That's thanks to Backscatter. We've written blogs showing how to do advanced hunting using only the malware_config modifier. Remember that you can search for samples by family name like malware_config:"redline" up to Telegram tokens and even URLs configured in the malware configuration like malware_config:"https://steamcommunity.com/profiles/76561198780612393" . Don't Overlook LNK File Metadata Threat actors often make operational security (OPSEC) mistakes. One common mistake is failing to remove metadata from files, including LNK (shortcut) files. This metadata can reveal information about the attacker's machine, such as the hostname. In the UNG0002 campaign, the actor consistently used LNK files with the same metadata, specifically the machine identifier laptop-g5qalv96 . We know that this information can be also modified by them to deceive security researchers, but often we observe good information that can be used to track them . This allowed the SEQRITE team to uncover a wider set of samples by querying VirusTotal for this metadata string. Track Actors via Leaked Bot Tokens Some malware, especially those using public platforms for command and control, will have hardcoded API tokens. As seen in the "Silent Lynx" campaign, a PowerShell script used a hardcoded Telegram bot token for C2 communication and data exfiltration. These tokens can be extracted from memory dumps during sandbox execution or from the malware's code itself. Once you have a token, you may be able to track the threat actor's commands and even identify other victims, as was done in the Silent Lynx investigation. A concrete example of using Telegram bot tokens is the query malware_config:"bot7213845603:AAFFyxsyId9av6CCDVB1BCAM5hKLby41Dr8" , which is associated with four infostealer samples uploaded between 2024 and 2025. Leverage Code-Signing Certificates Threat actors sometimes sign their malicious executables to make them appear legitimate. They may use stolen certificates or freshly created ones . These certificates can be a powerful pivot point. In the DRAGONCLONE case, a suspicious executable was signed by "ShenZhen Thunder Networking Technologies Ltd.". By searching for other files signed with the same certificate ( signature:"ShenZhen Thunder Networking Technologies Ltd." ), you can uncover other tools in the attacker's arsenal. Utilize YARA and Sigma Rules For proactive hunting, you can develop your own YARA rules to find malware families based on unique strings, code patterns, or other characteristics. This was a key technique in the "Silent Lynx" campaign for hunting similar implants. Additionally, you can leverage the power of the community by using crowdsourced Sigma rules in VirusTotal, even within your YARA rules . These rules can help you identify malicious behaviors, such as the DLL sideloading techniques used by DRAGONCLONE, directly from sandbox execution data. For example, If you want to search for the Sigma rule "Potential DLL Sideloading Of MsCorSvc.DLL" in VT files, you can use the query sigma_rule:99b4e5347f2c92e8a7aeac6dc7a4175104a8ba3354e022684bd3780ea9224137 to do so. All the Sigma rules are updated from the public repo and can be consumed here. Conclusion The success stories of the SEQRITE APT-Team in tracking campaigns like UNG0002, Silent Lynx, and DRAGONCLONE demonstrate the power of VirusTotal as a collaborative and comprehensive threat intelligence platform . By leveraging a combination of malware configuration analysis, metadata pivoting, and community-driven tools like YARA and Sigma rules, security researchers can effectively uncover and track sophisticated threat actors. These examples highlight that successful threat hunting is not just about having the right tools, but also about applying creative and persistent investigation techniques . The ability to pivot from one piece of evidence to another is crucial in connecting the dots and revealing the full scope of a campaign. The SEQRITE team has demonstrated a deep understanding of these pivoting techniques, and we appreciate that they have decided to share their valuable insights with the rest of the community. We hope these tips and stories have been insightful and will help you in your own threat-hunting endeavors. The fight against cybercrime is a collective effort, and the more we share our knowledge and experiences, the stronger we become as a community. If you have a success story of using VirusTotal that you would like to share with the community, we would be delighted to hear from you . Please reach out to us, and we will be happy to feature your story in a future blog post at practitioners@virustotal.com . Together, we can make the digital world a safer place. Email This BlogThis! Share to X Share to Facebook Newer Posts Home Older Posts 0 comments: Post a Comment Subscribe to: Post Comments (Atom) Copyright © VirusTotal Blog | Powered by Blogger Design by Automattic | Blogger Theme by NewBloggerThemes.com

📌 来源: VirusTotal Blog | 📅 2025-10-21