Fake Resume Delivers Malware to Cybersecurity Researchers

Key Takeaways

• Cybersecurity researchers are being targeted with a sophisticated malware campaign disguised as a student resume.
• The attack chain utilizes a fake graduate school application to deliver the SNOWLIGHT loader and the VShell remote access trojan (RAT).
• The malware employs a multi-stage, fileless approach, executing payloads in memory to evade detection.
• The lure is specifically tailored for academic targets, focusing on electrical engineering, energy systems, and applied AI.
• While the campaign’s operator remains unconfirmed, the use of a Chinese-language resume and academic context suggests a focus on mainland Chinese research institutions.

Cybersecurity researchers are increasingly becoming targets of highly tailored malware campaigns, with a recent incident involving a deceptive student resume designed to infect Windows systems with remote access tools. This sophisticated attack leverages a seemingly innocuous graduate school application to deploy a multi-stage, memory-based infection chain, ultimately installing the SNOWLIGHT loader and the potent VShell remote access trojan.

The deceptive resume purports to be from a recent graduate of the Beijing Institute of Technology, seeking research positions in specialized fields such as electrical engineering, energy systems, and applied AI. This specific focus strongly indicates that the primary targets are professors and laboratory staff within academic institutions, rather than typical corporate human resources departments. The attackers exploit the inherent trust associated with academic correspondence to establish an initial foothold for intrusion.

Himanshu Anand said in a report, detailing how the attack progresses through a complex sequence to deliver the SNOWLIGHT and VShell remote-access trojans. While the evidence points to a deliberate attempt to gain access to research workstations, the precise identity, nationality, or ultimate objectives of the operators behind this campaign have not yet been definitively established.

This incident underscores the critical need for academic personnel to exercise the same level of vigilance as corporate hiring teams. The convincing nature of the application exploits researchers’ expectation of reviewing unfamiliar files, while the legitimate-looking decoy document minimizes suspicion.

Fake Resume Targets Researchers

The attack initiates with a malicious ZIP archive, bearing a Chinese-language filename that identifies the supposed applicant as “Zhang Yuguang,” a network engineering graduate. Inside this archive lies an executable file, named almost identically to a document, designed to exploit the default Windows setting that hides known file extensions. This common trick makes the executable appear as a regular document.

Upon execution, the loader retrieves and displays a genuine DOCX resume to the recipient, giving the impression that a legitimate application is being reviewed. Simultaneously, the malicious process quietly runs in the background. It incorporates anti-analysis measures, checking for virtualized environments, refusing to proceed on systems with fewer than four CPU cores, and employing an unusual timing test before continuing its operations.

The content of the decoy resume is meticulously crafted to appeal to technical academics, making claims about AI-based power-grid fault diagnosis, renewable-energy control, and an interest in joining a supervisor’s research group. This level of customization suggests the attackers specifically tailored the lure for this academic audience. Similar tactics have been observed in attacks involving academic event materials, where trusted research contexts were similarly abused as cover.

While the Beijing Institute of Technology’s name lends credibility to the application, there is no indication that the institution itself was involved in, aware of, or received the malware. Anand’s assessment points to a mainland Chinese academic recipient as the most probable target context, though the identity of the operator remains unconfirmed. The initial program downloads encrypted shellcode and executes it directly in memory, bypassing traditional disk-based antivirus scans and making detection more challenging, a technique often associated with fileless malware.

SNOWLIGHT Opens Remote Access

The SNOWLIGHT shellcode, once active on the Windows system, establishes contact with its command-and-control (C2) server. After a brief system check-in, it receives a substantial 4.65 MB payload. This payload is then decoded, and execution is transferred to VShell, which subsequently registers with the same C2 server using encrypted communication.

This sequence successfully establishes a remote access foothold for the attackers. The analysis confirmed VShell’s registration and health checks, though direct observation of an operator issuing commands, transferring files, or attempting lateral movement was not captured during the analysis. It is crucial to differentiate confirmed malicious behavior from the broader capabilities that VShell could potentially offer, which include an interactive command shell, file transfer, screen capture, network discovery, and tunneling functionalities.

The broader adoption of the VShell framework by various threat actors has been documented, but the presence of the framework alone does not definitively link the activity to a specific threat group. This distinction is significant: while SNOWLIGHT and VShell have been observed in operations attributed to several clusters, they are also becoming more widely available to other malicious actors. Consequently, the report characterizes this as an unattributed actor utilizing a mainland-China-oriented academic lure, rather than a confirmed state-linked operation.

What You Should Do

• Verify Unsolicited Applications: Always verify the authenticity of unsolicited applications or attachments through an independent communication channel (e.g., a phone call to the institution or applicant’s official contact information) before opening any files.
• Enable File Extensions: Configure Windows to always show known file extensions to easily identify executables disguised as documents (e.g., resume.docx.exe instead of resume.docx).
• Block Executable Content: Implement policies to block executable content within unexpected archive files, especially those received via email.
• Monitor Process Behavior: Investigate any resume-themed programs that initiate command shells, launch Microsoft Word in unusual ways, or establish suspicious outbound network connections.
• Threat Hunting: Security teams should actively hunt for the listed Indicators of Compromise (IoCs), including specific network destinations, resume-themed executables, and the temporary marker (TEMPde.log) associated with this attack chain. Review related process and network telemetry for anomalies.
• Educate Staff: Conduct regular security awareness training for academic staff, researchers, and administrators on social engineering tactics, phishing, and the risks associated with opening attachments from unverified sources.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.