31/10/2026 –, Track 1 (306B) Langue: English
A targeted loader campaign first appeared as an AirJaldi firewall-update lure, then shifted delivery after responsible disclosure, and later reappeared as a Tibetan monastery archive and Dalai Lama teachings lure. The Windows loader copied itself as POWERFUL.exe, installed scheduled-task persistence, fetched a large encrypted second stage from blog.tibetanmonasteries.com, and executed it in process memory. This talk walks through the evidence chain: email headers, static analysis, Sysmon, pcaps, Volatility, x64dbg, Ghidra, and FLOSS. The final result is a recovered 36.7 MB Go PE with Sliver-style capability strings and a runtime Register object containing fish_tibet.
Note: AirJaldi is the ISP provider in and around the city I stay.
This session presents a full defensive analysis of a targeted malware campaign observed between 30 July and 12 August 2026. The initial lure used the display name AirJaldi_Billing and the subject URGENT: Firewall Installation Required - Network Security Update. The mail path showed a Brevo sender, not an AirJaldi-controlled sending domain. The download chain produced a Windows x64 loader disguised with firewall-update naming.
The stage-1 loader was small, unsigned, and behaviorally clear. Static strings and dynamic telemetry showed it creating a four-byte decoy PDF, copying itself to %LOCALAPPDATA%\POWERFUL.exe, installing a scheduled task named POWERFUL, contacting blog.tibetanmonasteries.com, allocating a 50 MiB buffer, marking memory executable, and transferring execution into the downloaded buffer.
After responsible disclosure, the delivery route changed. On 6 August 2026, the AirJaldi-hosted malware path was reported. Later, that original path was no longer reachable to the analyst. On 11 August, the same lure returned twice: first with a short-lived GitHub release URL, then with a working 103.83.58.138:8000 delivery URL. The delivery route changed, but the stage-1 SHA256 stayed the same.
On 12 August, the campaign theme shifted from firewall urgency to Tibetan cultural and religious material. A new email directed Tibet-related recipients to a Tibetan Monasteries Archive and advertised Dalai Lama teachings, manuscripts, chronicles, catalogues, and monastery study notes. The downloaded archive produced DalaiLama_Spiritual_Message_Ladakh.exe. This Aug 12 executable is not byte-identical to the earlier firewall sample, but it has the same PE timestamp, entry point, import hash, C2 domain, POWERFUL decoy/persistence strings, fake Chrome/1337 user-agent, WinHTTP usage, and VirtualProtect behavior. It is best tracked as a same-lineage loader variant.
The presentation focuses on how the second stage was proven and recovered. Network captures showed repeated DNS/SNI for blog.tibetanmonasteries.com, consistent TLS fingerprints, and a large server-to-client TLS transfer matching the recovered stage size. Sysmon tied file creation, task creation, DNS, and TLS connection activity to the malware process. Volatility dumps from earlier and later detonations recovered Sliver-style strings and a runtime Register object containing Name: fish_tibet and ActiveC2: https://blog.tibetanmonasteries.com.
The final recovery used x64dbg in an isolated VM. Breakpoints on memory allocation, protection changes, and thread creation exposed a region containing Go build metadata. Dumping that region produced a 36.7 MB PE32+ x64 Go binary. Ghidra and FLOSS identified Sliver-style capability strings including active C2 access, migration, process dumping, token manipulation, registry operations, SOCKS/forwarding, and in-process execution features.
The session ends with detection guidance and limits of interpretation. The evidence supports a Go-based Sliver or Sliver-derived implant and a runtime implant/profile name fish_tibet. It does not support actor attribution by itself, and shared CDN edge IPs are not treated as standalone infrastructure indicators.
Audience Takeaways
- How to prove an in-memory stage executed when the payload is not written to disk.
- How to correlate email, host telemetry, pcaps, memory, and reverse engineering into one evidence chain.
- How to recover a large Go stage from memory using debugger-assisted breakpoints.
- How to distinguish runtime implant identifiers from actor attribution.
- How to build detections using correlated host, network, and memory artifacts.
Samdup is an information security researcher and digital security trainer based in Dharamsala, India. Originally from Tibet, he holds an M.Sc. in Computer Science from Bangalore, India and, a Master’s in Cybersecurity from Georgia Tech. His work focuses on malware analysis, memory forensics, incident response, threat hunting, and practical defensive security.