Hackers Use Fake Student Resume to Secretly Install Malware on Researchers’ Computers

A fake student resume is being used to place a remote-access tool on researchers’ Windows computers. The campaign hides a Windows executable inside an archive that appears to contain a graduate-school application, then opens a genuine Word document while the infection runs quietly in the background.

The lure claims to come from a recent Beijing Institute of Technology graduate seeking research work in electrical engineering, energy systems and applied AI.

That focus points to professors and laboratory staff as likely targets, rather than ordinary corporate recruiters, and turns academic correspondence into a route for intrusion.

Himanshu Anand said in a report shared with Cyber Security News (CSN) that the attack delivers SNOWLIGHT and the VShell remote-access trojan through a multi-stage, memory-based chain.

The evidence supports targeted access to a research workstation, but does not establish the operator’s identity, nationality or final objective.

The incident shows why academic staff need the same caution applied to hiring teams. A believable application exploits the expectation that researchers will review unfamiliar files, while the decoy document gives victims little reason to suspect trouble.

Fake Resume Targets Researchers

The malicious ZIP archive uses a Chinese-language name that presents its supposed author as Zhang Yuguang, a network-engineering graduate. Inside is an executable with a near-identical document-style name, relying on Windows hiding known file extensions by default.

Once opened, the loader retrieves and launches a real DOCX resume, allowing the recipient to read the expected application.

At the same time, it checks for an analysis environment, refuses systems with fewer than four CPU cores, and uses an unusual timing test before continuing.

The decoy makes claims about AI-based power-grid fault diagnosis, renewable-energy control and joining a supervisor’s research group, suggesting that the attacker tailored it for technical academics.

Similar lures appear in this report on academic event material attacks, where trusted research context also served as cover. The university name gives the application credibility, but it is not evidence that the institution created, knew about or received the malware.

Anand assessed a mainland Chinese academic recipient as the most likely target context, while keeping attribution to the operator unresolved.

The initial program downloads encrypted shellcode and runs it in memory instead of saving a conventional payload to disk. This fileless approach can make routine disk-based checks less useful, as explained in coverage of how fileless malware works, while allowing the decoy to stay open.

SNOWLIGHT Opens Remote Access

The Windows SNOWLIGHT shellcode contacts the command server, sends a short system check-in and receives a 4.65 MB payload. It decodes that payload and transfers execution to VShell, which registers with the same server over encrypted traffic.

That sequence gave the attackers a remote-access foothold. The sample completed VShell registration and health checks, although the analysis did not capture an operator typing commands, transferring files or moving to another system.

Confirmed behavior must remain separate from capabilities that could be used later. VShell can provide an interactive command shell, file transfer, screen capture, network discovery and tunneling.

Its wider campaign use is examined in VShell threat actor adoption, but the framework alone does not identify a particular threat group.

That distinction matters here. SNOWLIGHT and VShell have appeared in activity associated with several clusters, yet are now available more widely.

The report therefore describes an unattributed actor using a mainland-China-oriented academic lure, not a confirmed state-linked operation.

Researchers, departments and IT teams should verify unsolicited applications through a separate contact channel before opening files.

They should enable visible extensions, block executable content in unexpected archives, and investigate resume-themed programs that start command shells, Word or unusual outbound connections.

Similar recruitment scams have targeted business teams through fake resume malware campaigns, showing that the social-engineering pattern extends beyond academia.

Security teams should hunt for the listed network destinations, resume-themed executables and the temporary marker associated with this chain, reviewing related process and network telemetry.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Archive filename	Beijing Institute of Technology_network engineering major_fresh graduate_Zhang Yuguang_personal resume (2)(1).zip	Malicious archive used as the initial delivery container
SHA-256	c25d4412f7f93e7de5b2aaf41747175d94cffd983ca20efbd0efcdd718b58c4d	Original malicious archive
SHA-256	81c51138d5527ca7dcc258171eb36659c479f66c86a8947b6340d040b3860a30	Go loader
MD5	a7cc7e3cdd2f0f9210044911a483fa5d	Go loader
SHA-256	f6d4da5afc89bf9e536a9002c4d256c696df2389d77279f4c5daf6979557e74e	Encrypted HTTP response
SHA-256	0524619d2471d77aba4b7993f5ffbaa4b8be6d2c0d91e63a02943851dc4b6404	SNOWLIGHT shellcode
SHA-256	ed2eaa6ef3eda95383b6efc35b88acbca742ad7bd118931f74727a3139ff7e97	XOR-encoded VShell payload stream
SHA-256	c666ac4f1a1b8df7ccfe8b19705279acd8b7eb7a4d0b3802bb3465064883ab25	Decoded VShell payload
SHA-256	de3f56d0d5b71f2a1a1905f0b01b84fbab237e9d4c5179a05b127d806823f83c	DOCX resume decoy
IP address	38.207.178.192	Campaign command-and-control and staging server
URL	http://38.207.178.192:50813/EasyConnectUpdata_Log.txt	Encrypted shellcode staging location
URL	http://38.207.178.192:50813/MySQL_LOG.txt	Word document decoy staging location
Network service	38.207.178.192:50813	HTTP staging service
Network service	38.207.178.192:50812	SNOWLIGHT check-in and VShell transfer service
AES key	YtWzxwZimsZoeMen	Embedded loader configuration decryption key
XOR key	0x99	Key used to decode the received VShell payload
Filename	TEMPde.log	SNOWLIGHT kill-switch or operator exclusion marker

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC