DragonSpark

DragonSpark is a cluster of opportunistic intrusions targeting organizations in East Asia. SentinelLABS assessed it is highly likely that a Chinese-speaking threat actor is behind the activity, but the reporting did not attribute it to a specific named group. The activity may support either espionage or cybercrime objectives. The campaign is characterized by consistent use of the open-source SparkRAT remote access trojan. Reporting describes DragonSpark as the first concrete malicious activity in which SentinelLABS observed sustained SparkRAT use. The actor also used Golang malware that interprets embedded Golang source code at runtime via Yaegi to hinder static analysis and evade detection, including the custom malware m6699.exe. Additional custom malware included ShellCode_Loader, a PyInstaller-packaged Python loader that decrypts and executes shellcode. Execution of both m6699.exe and ShellCode_Loader enabled Meterpreter sessions for remote command execution. Observed initial access involved compromises of Internet-exposed web servers and MySQL servers. On compromised web servers, China Chopper webshell activity was observed. After access, the actor conducted lateral movement, privilege escalation, and deployment of additional malware and tools from attacker-controlled infrastructure. DragonSpark relied heavily on open-source tools associated with Chinese-speaking developers or vendors, including SharpToken and BadPotato for privilege escalation and GotoHTTP for remote access, persistence, file transfer, and screen viewing. Kroll also reported ongoing campaigns using SPARKRAT with a previously undocumented Golang loader dubbed LESLIELOADER, which decodes and decrypts an embedded secondary payload and injects it into a suspended notepad.exe process. Kroll linked frequent SPARKRAT use to the DragonSpark campaign, but also noted LESLIELOADER is not exclusive to SPARKRAT. Infrastructure observed in the campaign included staging systems in Taiwan, Hong Kong, China, and Singapore, with command-and-control servers identified in Hong Kong and the United States. Known alias in the provided content: dragonspark.