Loading threat actor…
DragonSpark is a cluster of opportunistic intrusions targeting organizations in East Asia and assessed with high confidence to be operated by a Chinese-speaking threat actor. The activity has not been conclusively tied to a specific publicly named intrusion set, and its objectives have been assessed as potentially consistent with either espionage or cybercrime. DragonSpark is particularly notable for sustained operational use of SparkRAT, an open-source cross-platform remote access trojan written in Go, alongside custom loaders and shellcode-based execution chains designed to complicate analysis and evade detection. Observed initial access has involved compromises of Internet-exposed web servers and MySQL servers, including deployment of China Chopper webshells on compromised web infrastructure. After access is established, the actor has conducted lateral movement, privilege escalation, and follow-on deployment of additional malware and tooling. DragonSpark has made extensive use of tools associated with Chinese-speaking developers or vendors, including SharpToken and BadPotato for elevation to SYSTEM privileges, and GotoHTTP for remote access, persistence, file transfer, and screen viewing. Custom malware associated with the activity includes a Python-based shellcode loader and a Go-based loader referred to as m6699. The Python loader decrypts and executes shellcode in memory and has been used to establish Meterpreter sessions. The Go-based m6699 malware uses the Yaegi Go interpreter to evaluate embedded Go source code at runtime, then allocates executable memory and launches staged shellcode, ultimately enabling remote command execution through Meterpreter. This interpreter-based design is intended to hinder static analysis and signature-based detection. Related reporting has also described a Go loader dubbed LESLIELOADER used in campaigns involving SparkRAT. LESLIELOADER decodes and decrypts an embedded secondary payload and injects it into a legitimate process to evade detection, demonstrating DragonSpark-linked tradecraft that combines payload staging, in-memory execution, and process injection. Additional observed infrastructure linked to the broader activity has included staging systems in parts of East and Southeast Asia and command-and-control infrastructure outside the immediate target region. Overall, DragonSpark exhibits a toolset and workflow centered on initial exploitation of exposed services, webshell deployment, privilege escalation, remote administration, shellcode execution, and stealthy post-compromise operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
24 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 malware families attributed to this actor across reporting.
3 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
19 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Opportunistic intrusions against organizations in East Asia involving SparkRAT, China Chopper, Golang malware using runtime Golang source code interpretation for evasion, lateral movement, privilege escalation, and deployment of additional tools and malware.
Campaign associated with use of SPARKRAT (and related tooling) in attacks against organizations in East Asia; observed using a previously undocumented Golang loader (“LESLIELOADER”) to decrypt, decode, and inject payloads (including SPARKRAT) into notepad.exe for execution and evasion.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.