Dropping Elephant — Fondue.exe DLL Side-Loading Campaign

Dropping Elephant (aka APT-C-17 / Patchwork, an India-nexus espionage actor) is running a fresh campaign disclosed by Rapid7 on 2026-06-23. The intrusion begins with a spear-phished Windows shortcut (.lnk) masquerading as a PDF contract for a Chinese energy project. The shortcut kicks off a lightly-obfuscated PowerShell stage that stages files under C:\Users\Public\ and abuses DLL side-loading: the legitimate, signed Microsoft binary Fondue.exe is dropped alongside a malicious APPWIZ.cpl, which Fondue.exe loads in place of the genuine Windows control-panel applet.

The malicious applet patches AMSI and ETW in-process, then uses Donut shellcode to reflectively load a 32-bit Remote Access Trojan in memory. The RAT communicates over a Salsa20-encrypted channel. Persistence is a scheduled task named GoogleErrorReport that re-launches Fondue.exe every minute — a noisy, high-fidelity anchor for hunting.

The strongest defensive angle is the side-load lineage: a Microsoft-signed Fondue.exe executing from C:\Users\Public\ (rather than System32) and loading an APPWIZ.cpl from the same user-writable directory. That combination essentially never occurs in benign operation.

Defender priority: Hunt for Fondue.exe running from any non-System32 path, an APPWIZ.cpl written under C:\Users\Public\, and the GoogleErrorReport scheduled task. No public atomic IOCs (hashes/C2) were released — detection here is behavior-led; load IOCs into the §10 CSV as Rapid7 publishes them.

No atomic IOCs (file hashes, C2 IPs/domains) were published in the available reporting. This pack is intentionally behavior-led; the §10 CSV uses REPLACE_WITH_* placeholders so atomic indicators can be dropped in unmodified once Rapid7 releases its appendix. No indicator here is fabricated.

Hunt Hypotheses (fidelity-ordered)

1. H1 (high): Fondue.exe executes from a non-System32 path (e.g. C:\Users\Public\) — the side-load host. Near-zero FP.
2. H2 (high): A scheduled task named GoogleErrorReport is registered, recurring every minute.
3. H3 (high): A PE named APPWIZ.cpl is written under C:\Users\Public\ or another user-writable path.
4. H4 (medium): A .lnk launch spawns PowerShell that references C:\Users\Public\ with string-concatenation obfuscation.
5. H5 (medium): Fondue.exe is parented by the task scheduler (svchost/taskeng) on a tight recurring cadence.
6. H6 (low): Executable / encrypted payload files staged in C:\Users\Public\.

Attack Chain

• Windows Security log: Event ID 4698 (scheduled task created) where TaskName = GoogleErrorReport or any task whose action is Fondue.exe from a user path.
• Sysmon (if deployed): Event ID 7 — module load of APPWIZ.cpl by Fondue.exe from outside System32; Event ID 1 — Fondue.exe with an unusual parent or path.
• Mail gateway: Quarantine and hunt .lnk attachments (or archives containing them) themed as PDF contracts; alert on double-extension lures (.pdf.lnk).
• File system sweep: Enumerate C:\Users\Public\ for unexpected .exe/.cpl/encrypted blobs across the fleet.

Q1, Q2 and Q3 are all strong Custom IOA promotion candidates — each is a single, near-zero-FP behavior. Q4/Q6 stay Investigate-only pending baseline.

1 · AppLocker — deny execution from C:\Users\Public (PowerShell)

<!-- Deny execution from C:\Users\Public, the DroppingElephant staging path. -->
<!-- Import: Group Policy -> Computer Configuration -> Windows Settings -> Security
     Settings -> Application Control Policies -> AppLocker -> Executable Rules -->
<!-- SHIPS AS AuditOnly ON PURPOSE. Run it for at least a week and review EventID
     8003 before flipping EnforcementMode to "Enabled". -->
<RuleCollection Type="Exe" EnforcementMode="AuditOnly">
  <!-- Microsoft default allow rules -- DO NOT REMOVE. Without them, enforcing this
       collection blocks every executable on the machine, including your RMM agent. -->
  <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="(Default) All files in Program Files"
                Description="Allows Everyone to run applications in Program Files."
                UserOrGroupSid="S-1-1-0" Action="Allow">
    <Conditions><FilePathCondition Path="%PROGRAMFILES%\*" /></Conditions>
  </FilePathRule>
  <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="(Default) All files in Windows"
                Description="Allows Everyone to run applications in the Windows folder."
                UserOrGroupSid="S-1-1-0" Action="Allow">
    <Conditions><FilePathCondition Path="%WINDIR%\*" /></Conditions>
  </FilePathRule>
  <FilePathRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="(Default) All files -- Administrators"
                Description="Allows local Administrators to run all applications."
                UserOrGroupSid="S-1-5-32-544" Action="Allow">
    <Conditions><FilePathCondition Path="*" /></Conditions>
  </FilePathRule>

  <!-- Some installers and a few LOB apps stage to Users\Public. Audit for a week first. -->
  <FilePathRule Id="7c2f4d81-9b03-4a6e-8d15-3e7a0f9c6b22" Name="Deny execution from Users\Public for standard users"
                Description="DroppingElephant / Fondue stages and executes from the Public profile"
                UserOrGroupSid="S-1-5-32-545" Action="Deny">
    <Conditions>
      <FilePathCondition Path="%SYSTEMDRIVE%\Users\Public\*" />
    </Conditions>
  </FilePathRule>
</RuleCollection>

Prerequisites: the Application Identity service (AppIDSvc) must be Running/Automatic, set via GPO -- AppLocker evaluates nothing without it. Pilot OU. Reboot required: no (gpupdate /force to refresh policy).

Verify: during the AuditOnly week, review Applications and Services Logs > Microsoft > Windows > AppLocker > EXE and DLL for EventID 8003 (would-have-blocked). Zero unexpected entries means it is safe to set EnforcementMode="Enabled"; a real block then logs EventID 8004.

Rollback: set EnforcementMode="NotConfigured" and re-import, or unlink the GPO and run gpupdate /force. If a host is already locked out by an over-broad policy, boot to Safe Mode (AppLocker does not enforce there) and stop AppIDSvc, or delete %WINDIR%\System32\AppLocker\*.AppLocker.

2 · Enumerate side-load + persistence across a host

Get-ChildItem C:\Windows\System32\fondue.exe | Select-Object FullName,LastWriteTime  # baseline genuine copy
Get-ChildItem C:\ -Recurse -Filter fondue.exe -ErrorAction SilentlyContinue |
  Where-Object { $_.DirectoryName -notmatch 'System32|WinSxS' } |
  Select-Object FullName,LastWriteTime
Get-ScheduledTask | Where-Object { $_.TaskName -eq 'GoogleErrorReport' } | Select-Object TaskName,TaskPath,State
Get-ChildItem C:\Users\Public -Recurse -Include *.exe,*.dll,*.cpl -ErrorAction SilentlyContinue

3 · Remove the persistence task

Unregister-ScheduledTask -TaskName 'GoogleErrorReport' -Confirm:$false -ErrorAction SilentlyContinue

Capture the fondue.exe, appwiz.cpl, and any Public-staged payloads for hashing/IR before deletion — these become your tenant-local atomic IOCs.

Coverage is strong on the side-load and persistence anchors (Q1/Q2/Q3) and weak on the in-memory stages (AMSI/ETW patch, Donut RAT) and C2 — the latter has no published infrastructure to pin. Lean on the file/task anchors and fill Q7's RemoteAddressIP4 + the §10 CSV once Rapid7 releases atomic IOCs. Validation gates (§11) must pass before promoting Q1/Q2/Q3 to Custom IOAs.