Operation Silk Lure Scam: When Job Hunts Leads to Malware

Summary

A new cyber-espionage campaign, dubbed Operation Silk Lure, is actively targeting Chinese-speaking professionals within the FinTech, cryptocurrency exchange, and digital trading sectors.The attackers employ social engineering through fake Chinese-language résumés that deliver malicious .LNK files disguised as legitimate job applications. Once opened, these shortcuts execute scripts that deploy the ValleyRAT backdoor, granting attackers persistent access, surveillance capabilities, and data exfiltration functionality.

The campaign’s hallmark is its localized deception — using authentic Chinese-language details, such as references to South China Agricultural University and roles in Guangdong-based DeFi firms, to lure victims. The attack blends linguistic authenticity, technical sophistication, and targeted social engineering, turning a routine hiring interaction into a highly effective cyber intrusion.

Attack Details

The ValleyRAT malware campaign begins with weaponized emails containing .LNK shortcuts embedded in compressed archives or document attachments. When the victim opens the file, the shortcut executes keytool.exe, a self-extracting loader that decrypts and runs embedded shellcode via RC4 encryption.This chain ultimately loads ValleyRAT, which performs:

• System reconnaissance (collecting metadata, screenshots, and documents)
• Data exfiltration to remote C2 servers hosted under SONDERCLOUDLIMITED using .work domains mimicking job portals
• Persistence via scheduled “Security” tasks
• Anti-analysis routines including virtualization detection, AV enumeration via COM/WMI, and keylogging

The decoy PDF, posing as the résumé of “Li Hanbing,” a blockchain engineer, strengthens credibility by featuring fluent Simplified Chinese and legitimate industry experience, maximizing infection success among Chinese-language targets.The attackers’ approach demonstrates hybrid tactics: human deception coupled with modular malware deployment, marking Operation Silk Lure as a sophisticated and persistent threat to Asia’s financial and crypto sectors.

Recommendations

1. Exercise Caution with Job-related Emails: Avoid opening unsolicited résumés or job files—particularly .LNK, .ZIP, or .RAR attachments. Legitimate candidates or recruiters typically use .PDF or .DOCX formats.
2. Restrict Shortcut File Execution: Use Group Policy or endpoint protection to disable or restrict .LNK execution.
3. Harden Email Security: Implement sandboxing, attachment scanning, and domain verification for inbound emails.
4. Apply Least Privilege Controls: Limit script execution and untrusted binary launches (e.g., keytool.exe) to reduce lateral spread.
5. Enhance Endpoint Defense: Use NGAV and EDR solutions with behavioral analytics and machine learning to detect suspicious activity in real time.

Indicators of Compromise (IoCs)

MITRE ATT&CK TTPs

TacticTechnique IDTechnique DescriptionInitial AccessT1566 / T1566.001Phishing and spear-phishing attachmentsExecutionT1059 / T1204.002Command scripting and malicious file executionPersistenceT1053.005 / T1547.001Scheduled tasks and registry run keysPrivilege EscalationT1055 / T1068Process injection and privilege abuseDefense EvasionT1027 / T1036 / T1497Obfuscation, masquerading, and sandbox evasionCredential AccessT1056 / T1555Keylogging and credential extractionCollectionT1113 / T1083 / T1005Screen capture and local file discoveryExfiltrationT1041 / T1071.001Exfiltration over web protocolsCommand & ControlT1071 / T1047C2 via HTTP/HTTPS and WMI

References

• Seqrite Research: Operation Silk Lure Analysis
• Hive Pro Threat Advisory: ValleyRAT DLL Hijacking Attack

SEO Keywords: Operation Silk Lure, ValleyRAT malware, FinTech phishing campaign, cryptocurrency cyber attack, Chinese-language spear-phishing, malicious LNK files, job-themed malware, RC4 decryption loader, SONDERCLOUDLIMITED C2 domains, DLL hijacking, Windows persistence malware, keylogging and exfiltration attacks.