UNK_DropPitch

UNK_DropPitch is a China-aligned threat actor tracked by Proofpoint, with overlapping activity tracked by Volexity as UTA0388. The actor conducted targeted phishing campaigns in 2025 against financial investment professionals and analysts at major investment firms specializing in Taiwan’s semiconductor and technology sectors, and was also reported as part of broader targeting related to Taiwan’s semiconductor industry. In reported activity, the actor impersonated fictitious investment firms and used phishing emails to deliver malicious ZIP or RAR archives containing vulnerable executables and malicious DLLs for DLL sideloading. Payloads included the custom backdoor HealthKick, described by Volexity as overlapping with or preceding the Go-based GOVERSHELL family, as well as a simple raw TCP reverse shell. Proofpoint reported HealthKick communicating over TCP port 465 using FakeTLS and XOR encoding, and later activity using a raw TCP reverse shell; Proofpoint also observed deployment of Intel Endpoint Management Assistant (EMA) after initial enumeration when targets were of interest. Volexity reported that overlapping UTA0388 activity used tailored and rapport-building phishing, fabricated personas, and lures in multiple languages including English, Chinese, Japanese, French, and German, while abusing legitimate services such as Netlify, Sync, OneDrive, Proton Mail, Outlook, and Gmail. OpenAI reported that accounts associated with UNK_DropPitch/UTA0388 used ChatGPT to generate phishing content in English, Chinese, and Japanese and to assist malicious workflows; those accounts were banned. Reported targeting also included US academia, US think tanks, and organizations representing Chinese minorities. Known alias: UTA0388.