Hackers Use GoogleErrorReport Scheduled Task for Persistence in Dropping Elephant Campaign

A well-known threat actor called Dropping Elephant has returned with a refined and more dangerous campaign, using a China-themed lure document to drop a reworked remote access trojan (RAT) onto victim machines.

The attack is designed to stay hidden, avoid detection tools, and give the attacker full control over compromised systems. What makes this campaign stand out is how deeply the attackers updated their methods while keeping their recognizable core tradecraft intact.

The campaign starts with a malicious Windows shortcut file named GRES3001.lnk, disguised as a PDF related to an industrial energy contract.

When a victim opens the file, it quietly launches a PowerShell script that downloads additional malware from a staging server at chinagreenenergy[.]org. A decoy document about a GRES-3 seawater pump contract is shown to the victim while the attack continues in the background.

Researchers from Rapid7 identified this campaign during a proactive threat hunt and published a report shared with Cyber Security News (CSN).

Their analysis confirmed this activity as a direct evolution of Dropping Elephant’s tradecraft, noting overlaps in delivery patterns, screenshot logic, beaconing behavior, and command-handler structure.

The researchers were also able to download all attack artifacts since the staging server was still active at the time of analysis.

The downloaded files include a legitimate Microsoft binary called Fondue.exe, which is used to side-load a malicious loader disguised as APPWIZ.cpl.

That loader decrypts an encrypted file called editor.dat and passes the result to a Donut shellcode loader, which maps the final RAT directly into memory without writing it to disk. Loading the payload entirely in memory allows the attackers to sidestep most traditional file-based detection methods.

Once active, the RAT fingerprints the victim machine and connects to a command-and-control server at gcl-power[.]org over encrypted HTTPS traffic on port 443.

It checks in every 10 seconds and is capable of running commands, listing files, capturing screenshots, uploading files, and downloading additional tools. This level of access gives the operator full visibility and control over the infected host.

Hackers Use GoogleErrorReport Scheduled Task for Persistence

After staging all necessary files in the C:UsersPublic folder, the PowerShell script creates a scheduled task named GoogleErrorReport.

This task is configured to run Fondue.exe every single minute, ensuring the malware restarts automatically and stays active even if interrupted.

The name GoogleErrorReport is deliberately chosen to blend in with normal system activity and avoid raising suspicion.

The script then deletes the original shortcut file, removing the most visible trace of the initial infection.

From that point, the scheduled task becomes the sole persistence mechanism, repeatedly triggering the DLL side-loading chain that loads the RAT into memory.

Rapid7 noted that defenders should watch for a scheduled task by this exact name running binaries from C:UsersPublic, as it is one of the clearest detection opportunities in this campaign.

Advanced Evasion and Anti-Analysis Capabilities

The final RAT is designed to frustrate security researchers and bypass detection tools.

It uses control-flow flattening to scramble code structure, checks for processes tied to debuggers and sandboxes, resolves its API functions at runtime, and patches Windows security features including AMSI, WLDP, and ETW before executing its payload.

These layers of evasion make both static and dynamic analysis significantly harder. Before connecting to its C2 server, the RAT quietly pings google.com, yahoo.com, and cloudflare.com to confirm internet access.

It checks the host’s public IP through api.ipify.org and uses ip2c.org to identify the victim’s country. All communication is encrypted with the Salsa20 cipher and wrapped in Base64 encoding, making intercepted traffic very difficult to analyze.

Rapid7 recommends defenders avoid relying solely on IOCs, since hashes, filenames, and infrastructure are likely to shift across campaigns.

Instead, teams should focus on behavioral signals such as shortcut files spawning PowerShell, files staged in C:UsersPublic, and any scheduled task named GoogleErrorReport running binaries outside a legitimate Windows directory.

Endpoint tools should also be reviewed for their ability to detect memory-resident payloads and in-process tampering with controls like AMSI and ETW.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.