Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain

Rapid7 details an advanced Dropping Elephant malware campaign that uses a China-themed decoy to deliver a heavily reworked, in-memory remote access trojan (RAT). The chain abuses DLL side‑loading of a legitimate Microsoft binary (Fondue.exe) and uses Donut shellcode to map the RAT directly into memory, plus multiple hardening/evasion techniques (control‑flow flattening, runtime API reconstruction, stealthy C2). Rapid7 recommends focusing on behavioral detection and memory‑level visibility (e.g., shortcut spawning PowerShell, files staged in C:\Users\Public\, suspicious scheduled tasks) rather