China-Aligned UTA0388 Uses LLM-Assisted Phishing and GOVERSHELL Malware, Volexity Reports
Summary
Volexity details UTA0388’s multilingual spear-phishing campaigns, rapport-building tactics, and five GOVERSHELL backdoor variants, assessing with high confidence that the China-aligned actor used LLMs to support its operations.
Key points
- Volexity tracked UTA0388 campaigns from June 2025, targeting organizations and users across North America, Asia, and Europe; the campaigns focused in part on Asian geopolitical issues and Taiwan.
- Phishing lures delivered ZIP or RAR archives through cloud services or actor-controlled servers. From August, some campaigns first built rapport over email before sending malicious links.
- Running the archive’s legitimate-looking executable loads a malicious DLL through Windows search-order hijacking, installing a GOVERSHELL backdoor.
- Volexity identified five GOVERSHELL variants, which use scheduled tasks for persistence and enable command execution; their C2 methods and capabilities changed across variants.
- Volexity cites fabricated identities, mismatched languages and personas, nonsensical archive contents, and malware development artifacts as evidence supporting its assessment of LLM use, while noting no single indicator proves it.
- OpenAI’s October 2025 report confirmed that UTA0388 used ChatGPT for several phishing and malware-development tasks, according to Volexity.
- Activity reportedly slowed from its July 2025 peak but remained ongoing, with continued GOVERSHELL development. Volexity recommends using its published indicators of compromise and detection rules.
Article Details
- Attack Vectors
- Spear-phishing emails linked to remotely hosted ZIP or RAR archives containing a legitimate-looking executable and a malicious DLL.
- In rapport-building phishing, UTA0388 first engaged targets in benign email conversations and sent malicious links only after receiving replies.
- Executing the archive's executable loaded the accompanying DLL through search-order hijacking and installed a GOVERSHELL variant.
- GOVERSHELL established persistence with scheduled tasks and enabled remote command execution through CMD or PowerShell, depending on the variant.
- Defensive Notes
- Volexity recommends using the IOCs and detection rules referenced in its report.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | azure-app[.]store | Impersonation-themed domain used by UTA0388 for GOVERSHELL command-and-control. |
| DOMAIN | cdn-apple[.]info | Impersonation-themed domain used by UTA0388 for GOVERSHELL command-and-control. |
| DOMAIN | doccloude[.]info | Legitimate-sounding domain used by UTA0388 for GOVERSHELL command-and-control. |
| DOMAIN | moctw[.]info | Domain used by UTA0388 for GOVERSHELL command-and-control. |
| DOMAIN | researchanalytics[.]co[.]uk | Fabricated domain used in UTA0388 phishing email signatures. |
| DOMAIN | sliddeshare[.]online | Impersonation-themed domain used by UTA0388 for GOVERSHELL command-and-control. |
| DOMAIN | twmoc[.]info | Domain used by UTA0388 for GOVERSHELL command-and-control. |
| DOMAIN | windows-app[.]store | Impersonation-themed domain used by UTA0388 for GOVERSHELL command-and-control. |
| URL | hxxps[:]//aesthetic-donut-1af43s2[.]netlify[.]app/file/rar | Phishing URL used to deliver a malicious archive. |
| URL | hxxps[:]//aesthetic-donut-1af43s2[.]netlify[.]app/index/file/A_Introduction_Docs_v00546823[.]rar | URL hosting a malicious RAR archive delivered by the phishing link. |
MITRE ATT&CK
T1053.005 · Scheduled TaskGOVERSHELL variants established persistence using Windows scheduled tasks.T1059.001 · PowerShellGOVERSHELL variants executed commands through PowerShell.T1059.003 · Windows Command ShellThe early GOVERSHELL variant could execute commands through cmd.exe.T1071.001 · Web ProtocolsGOVERSHELL variants communicated with command-and-control over HTTPS.T1105 · Ingress Tool TransferTargets downloaded malware-containing ZIP or RAR archives from links in phishing emails.T1204.002 · Malicious FileInfection required the target to execute the legitimate-looking executable extracted from the archive.T1566.002 · Spearphishing LinkUTA0388 sent spear-phishing emails containing links to malicious archives.T1573 · Encrypted ChannelGOVERSHELL variants encrypted command-and-control communications using AES; some variants also wrapped traffic in TLS headers.T1574.001 · DLLThe executable loaded a malicious DLL placed alongside it through search-order hijacking.
Threat Actors
Malware
Vendors
Products
ChatGPTThat report confirms Volexity’s suppositions that UTA0388 leveraged OpenAI’s ChatGPT platform for several components of their spear phishing and malware development operations.Microsoft WindowsCan execute commands directly on the Windows command prompt ( cmd.exe /c <command>).PowerShellPowerShell Reverse ShellTablacus Explorerfrom the legitimate version of either the 32- or 64-bit version of an open-source project called Tablacus Explorer.