China-aligned UTA0388 Targets Multiple Regions with GOVERSHELL Malware
Summary
Hide ▲
Show ▼
A China-aligned threat actor, UTA0388, has conducted spear-phishing campaigns targeting North America, Asia, and Europe to deliver the GOVERSHELL backdoor. These campaigns use tailored lures and fictional identities in multiple languages. The malware, which has evolved through several variants, is designed to execute commands and gather system information. The actor has also leveraged legitimate services like Netlify, Sync, and OneDrive to stage archive files and used OpenAI ChatGPT to generate phishing content and assist with malicious workflows. The campaigns have been highly tailored, with the threat actors building trust with recipients over time before sending malicious links. The malware variants include HealthKick, TE32, TE64, WebSocket, and Beacon, each with different capabilities for command execution and system information gathering. The targeting profile indicates a focus on Asian geopolitical issues, particularly Taiwan. Additionally, a separate campaign targeting European institutions has been observed, involving the use of PlugX malware.
Timeline
-
09.10.2025 20:19 1 articles · 15h ago
UTA0388 Conducts Spear-Phishing Campaigns with GOVERSHELL Malware
A China-aligned threat actor, UTA0388, has conducted spear-phishing campaigns targeting North America, Asia, and Europe to deliver the GOVERSHELL backdoor. These campaigns use tailored lures and fictional identities in multiple languages. The malware, which has evolved through several variants, is designed to execute commands and gather system information. The actor has leveraged legitimate services like Netlify, Sync, and OneDrive to stage archive files and used OpenAI ChatGPT to generate phishing content and assist with malicious workflows. The campaigns have been highly tailored, with the threat actors building trust with recipients over time before sending malicious links. The targeting profile indicates a focus on Asian geopolitical issues, particularly Taiwan. Additionally, a separate campaign targeting European institutions has been observed, involving the use of PlugX malware.
Show sources
- From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware — thehackernews.com — 09.10.2025 20:19
Information Snippets
-
UTA0388 has conducted spear-phishing campaigns targeting North America, Asia, and Europe.
First reported: 09.10.2025 20:191 source, 1 articleShow sources
- From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware — thehackernews.com — 09.10.2025 20:19
-
The campaigns use tailored lures and fictional identities in multiple languages, including English, Chinese, Japanese, French, and German.
First reported: 09.10.2025 20:191 source, 1 articleShow sources
- From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware — thehackernews.com — 09.10.2025 20:19
-
The malware, GOVERSHELL, has evolved through several variants: HealthKick, TE32, TE64, WebSocket, and Beacon.
First reported: 09.10.2025 20:191 source, 1 articleShow sources
- From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware — thehackernews.com — 09.10.2025 20:19
-
The malware is designed to execute commands and gather system information.
First reported: 09.10.2025 20:191 source, 1 articleShow sources
- From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware — thehackernews.com — 09.10.2025 20:19
-
The actor has leveraged legitimate services like Netlify, Sync, and OneDrive to stage archive files.
First reported: 09.10.2025 20:191 source, 1 articleShow sources
- From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware — thehackernews.com — 09.10.2025 20:19
-
The actor has used OpenAI ChatGPT to generate phishing content and assist with malicious workflows.
First reported: 09.10.2025 20:191 source, 1 articleShow sources
- From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware — thehackernews.com — 09.10.2025 20:19
-
The campaigns have been highly tailored, with the threat actors building trust with recipients over time.
First reported: 09.10.2025 20:191 source, 1 articleShow sources
- From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware — thehackernews.com — 09.10.2025 20:19
-
The targeting profile indicates a focus on Asian geopolitical issues, particularly Taiwan.
First reported: 09.10.2025 20:191 source, 1 articleShow sources
- From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware — thehackernews.com — 09.10.2025 20:19
-
A separate campaign targeting European institutions has been observed, involving the use of PlugX malware.
First reported: 09.10.2025 20:191 source, 1 articleShow sources
- From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware — thehackernews.com — 09.10.2025 20:19