Swan Vector: A Precision Espionage Campaign Targeting East Asia
A newly identified cyber campaign—codenamed “Swan Vector”—has surfaced, executing a series of meticulously crafted attacks against institutions in East Asia, with a concentrated focus on Taiwan and Japan.
The operation appears to be the work of a highly capable adversary leveraging a modular attack architecture and social engineering ploys to infiltrate academic entities and engineering firms.
Covert Delivery and Multi-Stage Payload Execution
Active since at least December 2024, the campaign initiates with a booby-trapped ZIP archive, which contains:
- A shortcut file (.LNK) disguised as a legitimate PDF document.
- A deceptive PNG file that is, in reality, a DLL implant camouflaged to evade superficial inspection.
Once activated, the attack triggers a four-phase compromise pipeline, each layer designed to reinforce the next while maintaining stealth and persistence. The final payload culminates in the deployment of Cobalt Strike, enabling full command-and-control capabilities.
Weaponized Social Engineering
The attackers employ localized decoys, including fake Japanese-language resumes, to tailor their lures to specific targets. File names such as “Detailed Documentation of Withdrawal Delay Issues and Related Transaction Records.pdf.lnk” add credibility and urgency, increasing the likelihood of victim interaction.
Technical Sophistication and Evasion Techniques
What distinguishes Swan Vector is its deep focus on anti-analysis and detection evasion. The initial payload, a custom-named DLL dubbed “Pterois”, is executed via rundll32.exe and leverages:
- Custom API resolution using proprietary hashing algorithms, making static analysis more difficult.
- Obfuscation layers that frustrate sandbox analysis and reverse engineering.
Attribution and Threat Context
Discovered by Seqrite Labs in April 2025, this campaign’s operational methods and tooling hint at possible affiliations with advanced persistent threat (APT) groups known to operate in the East Asian theater. While definitive attribution remains ongoing, the attack precision, regional targeting, and tradecraft suggest a well-funded, state-aligned entity.
“The architectural depth and operational discipline of this malware framework point to a deliberate, long-term intelligence-gathering effort,” said Subhajeet Singha, Security Researcher at Seqrite.
Deep-Dive: The Stealth Architecture Behind Swan Vector’s Infection Chain
Researchers at Seqrite have uncovered a stealth-centric malware execution model used in the Swan Vector campaign, which eschews conventional API referencing in favor of runtime resolution through obfuscation.
Dynamic API Resolution via Custom Hashing
To bypass static detection, the malware dynamically resolves system APIs using a custom-built 32-bit SDBM-inspired hashing mechanism. Instead of invoking known system functions directly, it translates obfuscated strings into function pointers at runtime.
Here’s a simplified view of the hash function’s logic:
python
def sdbm_case_insensitive_32bit(s):
hash_val = 0
mod_value = 2**32
for char in s:
if ‘a’ <= char <= ‘z’:
char = char.upper()
hash_val = (hash_val * 65599 + ord(char)) % mod_value
return hash_val
This method ensures function names never appear in plaintext, neutralizing common static analysis tools and significantly raising the bar for reverse engineering.
Staged Intrusion via Legitimate System Tools
After initial execution, the malware chain pivots into DLL sideloading, a technique that misuses trusted Windows binaries to execute malicious code under the radar. These stages are modular, compartmentalized, and designed for persistence and adaptability.
One notable stage includes the deployment of “Isurus”, a second-stage implant responsible for decrypting and executing Cobalt Strike shellcode hidden within a file named ra.ini.
Command-and-Control via Public Cloud Infrastructure
In a further twist on evasive strategy, Swan Vector routes its C2 traffic through Google Drive, a tactic that masks its communications within the flow of everyday business operations. By leveraging valid OAuth authentication protocols, the malware seamlessly interacts with Google’s APIs to retrieve payloads—effectively hiding in plain sight.
This strategy minimizes the risk of raising alarms in network monitoring systems that are tuned to detect unusual or suspicious domains.
Attribution and Actor Profile
While definitive attribution remains complex, forensic overlap in technique, tooling, and tradecraft suggests operational similarities with groups such as APT10, Lazarus Group, and Winnti.
Based on:
- Encrypted payload management
- Sophisticated implant layering
- Region-specific lure content
…the activity is assessed with medium confidence to originate from an East Asian threat actor, likely aligned with state-level interests.
Actionable Insight
Organizations, particularly those operating in Taiwan, Japan, and adjacent sectors, should adopt multi-layered detection frameworks, disable execution from user-writable directories, and scrutinize cloud service traffic for anomalies.
Even benign-looking files—such as job applications or transactional PDFs—could be tailored traps in campaigns like Swan Vector, engineered to breach trust before breaching networks.
