Elephant APT Group Attacking Defense Industry Leveraging VLC Player, and Encrypted Shellcode

The malware creates a mutex named “ghjghkj” to prevent multiple instances and implements seven distinct command handlers, including screenshot capture (3SC3), file upload (3ngjfng5), and remote code execution (3gjdfghj6) capabilities, providing comprehensive system control to the attackers. The attack chain begins by downloading a legitimate VLC Media Player executable (originally named “lama”) alongside a malicious libvlc.dll library (originally “lake”). This malicious operation represents a significant evolution in the group’s capabilities, employing a complex five-stage execution chain that cleverly disguises malicious payloads as legitimate conference invitations related to unmanned vehicle systems. Arctic Wolf researchers identified this campaign as part of Dropping Elephant’s expanded targeting scope, noting the group’s strategic shift from traditional South Asian targets to NATO-allied defense industries. This DLL serves as a shellcode loader responsible for decrypting and executing the final payload stored in vlc.log. The decryption process utilizes a hardcoded key “76bhu93FGRjZX5hj876bhu93FGRjX5” to transform the encrypted shellcode into a functional x86 PE executable. The Dropping Elephant advanced persistent threat group has launched a sophisticated cyber-espionage campaign targeting Turkish defense contractors, particularly companies manufacturing precision-guided missile systems. The malware demonstrates sophisticated evasion techniques by abusing legitimate software components, specifically VLC Media Player and Microsoft Task Scheduler, through DLL side-loading mechanisms. The attack begins with a weaponized LNK file named “Unmanned_Vehicle_Systems_Conference_2025_In_Istanbul.lnk” that masquerades as an invitation to a UAV conference scheduled for July 2025 in Istanbul. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This task executes the compromised VLC player every minute, ensuring continuous system access while maintaining the appearance of legitimate media player activity. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 25 Jul 2025 02:45:16 +0000