Operation DupeHike Attacking Employees Using Weaponized Documents DUPERUNNER Malware
A recent sophisticated attack, termed Operation DupeHike, poses a substantial threat to Russian corporate settings, specifically targeting employees in human resources, payroll, and administrative departments.
A recent sophisticated attack, termed Operation DupeHike, poses a substantial threat to Russian corporate settings, specifically targeting employees in human resources, payroll, and administrative departments.
This campaign, attributed to the threat group UNG0902, employs decoy documents centered on themes such as employee bonuses and internal financial policies to deploy a previously unidentified malware ecosystem onto victims' systems.
The attack initiates with spear-phishing emails containing ZIP archives masquerading as authentic corporate documents. These archives, named "Премия 2025.zip" (translated to "Bonus.Zip" in English), house malicious shortcut files (.LNK) that mimic PDF documents, employing filenames such as "Document_1_On_the_size_of_the_annual_bonus.pdf.lnk" to deceive recipients.
Seqrite security analysts identified this campaign upon discovering a malicious ZIP archive on VirusTotal on Tue, Nov 21, 2025. The research team observed that the threat actors display an advanced understanding of Russian corporate HR workflows, crafting decoy documents that detail realistic bonus structures related to performance metrics, KPIs, and organizational objectives.
Infection Mechanism and Technical Breakdown
The infection sequence involves three distinct stages, beginning with the execution of malicious LNK files. When a victim opens the shortcut file, PowerShell is executed covertly in the background using specific flags: NoNI, nop, and w hidden parameters.
The script employs Invoke-WebRequest to download a second-stage implant named DUPERUNNER from an attacker-controlled server at 46.149.71.230.
The attack initiates with spear-phishing emails containing ZIP archives masquerading as authentic corporate documents.
DUPERUNNER, compiled using C++, performs essential reconnaissance and injection operations. The malware includes several functions designed to maintain persistence and evade detection.
It enumerates target processes such as explorer.exe, notepad.exe, and msedge.exe for injection purposes while also downloading decoy PDFs to present to users, thereby creating the illusion of legitimate document processing.
Subsequently, the implant executes remote thread injection to load the final payload: an AdaptixC2 beacon. This command-and-control beacon uses HTTP POST requests to communicate with attacker infrastructure, facilitating remote command execution and data exfiltration capabilities.
The beacon utilizes dynamic API resolution with djb2-style hashing to evade static detection signatures.
Seqrite researchers extracted configuration artifacts, revealing the beacon identification numbers and command-and-control infrastructure hosted on servers under ASN 48282 and AS 9123, managed by VDSINA-AS and TIMEWEB-AS.
The infrastructure illustrates port configuration adjustments from port 80 during implant delivery to port 443 for final beacon operations, signifying continuous refinement of attack infrastructure.
This campaign exemplifies an evolving threat landscape where advanced social engineering merges with sophisticated malware capabilities to target corporate environments in Eastern Europe.
Based on reporting by Cyber Security News.