From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware

According to Volexity, a China-aligned threat actor codenamed UTA0388 has been attributed to spear-phishing campaigns aimed at North America, Asia and Europe to deliver a Go-based implant known as GOVERSHELL. The group’s activity is described as “highly tailored” in follow-on waves, with lures and multilingual identities including English, Chinese, Japanese, French and German, and links leading to a ZIP or RAR archive containing a rogue DLL payload.

GOVERSHELL is viewed as a successor to HealthKick, a C++ malware family, and as many as five variants have been identified to date: HealthKick (first observed April 2025), TE32 (first observed June 2025), TE64 (first observed early July 2025), WebSocket (first observed mid-July 2025) and Beacon (first observed September 2025).

The campaigns abuse legitimate services such as Netlify, Sync and OneDrive, with messages sent from Proton Mail, Microsoft Outlook and Gmail, and the payload is launched via DLL side-loading after the user clicks a link. Notably, OpenAI ChatGPT is reported to have been used to generate phishing content and assist malicious workflows, though the accounts have since been banned, and Volexity notes potential automation and use of large language models in the operation.