DragonSpark

DragonSpark is a cluster of opportunistic intrusions targeting organizations in East Asia and assessed with high confidence to be operated by a Chinese-speaking threat actor. The activity has not been conclusively tied to a specific publicly named intrusion set, and its objectives have been assessed as potentially consistent with either espionage or cybercrime. DragonSpark is particularly notable for sustained operational use of SparkRAT, an open-source cross-platform remote access trojan written in Go, alongside custom loaders and shellcode-based execution chains designed to complicate analysis and evade detection. Observed initial access has involved compromises of Internet-exposed web servers and MySQL servers, including deployment of China Chopper webshells on compromised web infrastructure. After access is established, the actor has conducted lateral movement, privilege escalation, and follow-on deployment of additional malware and tooling. DragonSpark has made extensive use of tools associated with Chinese-speaking developers or vendors, including SharpToken and BadPotato for elevation to SYSTEM privileges, and GotoHTTP for remote access, persistence, file transfer, and screen viewing. Custom malware associated with the activity includes a Python-based shellcode loader and a Go-based loader referred to as m6699. The Python loader decrypts and executes shellcode in memory and has been used to establish Meterpreter sessions. The Go-based m6699 malware uses the Yaegi Go interpreter to evaluate embedded Go source code at runtime, then allocates executable memory and launches staged shellcode, ultimately enabling remote command execution through Meterpreter. This interpreter-based design is intended to hinder static analysis and signature-based detection. Related reporting has also described a Go loader dubbed LESLIELOADER used in campaigns involving SparkRAT. LESLIELOADER decodes and decrypts an embedded secondary payload and injects it into a legitimate process to evade detection, demonstrating DragonSpark-linked tradecraft that combines payload staging, in-memory execution, and process injection. Additional observed infrastructure linked to the broader activity has included staging systems in parts of East and Southeast Asia and command-and-control infrastructure outside the immediate target region. Overall, DragonSpark exhibits a toolset and workflow centered on initial exploitation of exposed services, webshell deployment, privilege escalation, remote administration, shellcode execution, and stealthy post-compromise operations.