Operation Dragon Castling suspected APT group hijacks WPS Office updater to target East Asian bettin

Researchers from Avast present a comprehensive analysis of a suspected Chinese APT campaign targeting the online gambling industry and dissidents across Asia. The attack exploits a vulnerability in the WPS Office updater—widely deployed in Asian countries—in combination with social engineering attacks.

The infection chain comprises three stages. Stage 1 uses a binary masquerading as "setup.CN" (mimicking WPS Office setup) that leverages a simple registry modification (no privilege escalation required) to hijack the WPS update process, enabling arbitrary executable downloads from a malicious server. Stage 2 performs privilege escalation via COM session moniker exploitation and deploys AES256-encrypted binaries with configuration files and UAC-bypass helpers stored in resources. Stage 3 (the "corrects" DLL) employs side-loading, stores encrypted payloads in resources, and uses sophisticated shellcode techniques: the malware enumerates ntdll exports, constructs an array of ZW function hashes ordered by RVA, and executes syscalls directly using the syscall instruction—effectively bypassing API hooking-based security product hooks.

The recovered modular malware component "Proto8" (written in C++) manages plugins retrieved from Chinese cloud storage and supports nine different communication protocols configured externally. The "Malcolm" RAT plugin provides full remote access capabilities: file operations, process creation, disk enumeration, system information collection, and encrypted/compressed HTTP/TCP communication with proxy authentication support.

Persistence is established through two primary mechanisms: registering as a security support provider and hijacking Winsock library loading paths. UAC bypass leverages specific COM interfaces. The attackers also disable system protections through registry manipulation affecting UIC (User Interface Control) settings.

Victims span multiple Asian countries: dissidents in China and Hong Kong, gambling companies in Taiwan and the Philippines, government institutions and railways in Taiwan, and telecom companies in Kazakhstan. The campaign reflects dual motivation—political (China's documented crackdown on gambling) and financial (money in the gaming industry), with some incidents involving ransomware use.

While researchers identified code similarities between Malcolm and the ffrat malware family, and between ffrat and WinningTi samples (matching debug strings and implementation patterns), they exercised attribution caution, concluding only that evidence suggests probable collaboration among Chinese threat groups.