Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain

Rapid7 researchers tracked a sophisticated Dropping Elephant campaign that uses a China-themed decoy to deliver a heavily reworked, in-memory remote access trojan (RAT). The chain employs DLL side‑loading of a legitimate Microsoft binary (Fondue.exe) and "Donut" shellcode to map the RAT into memory, with additional evasion like control‑flow flattening, runtime API reconstruction, and hardened C2. Rapid7 emphasizes behavior-based detection (memory visibility, threat hunting) over IOCs: notable behaviors include shortcut files spawning PowerShell, files staged in C:\Users\Public\, and the use of