Malware

ManageEngine UEMS agent

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059.001PowerShellEvidence1

The script also builds command names dynamically, including `msiexec.exe`, `powershell.exe`, `certutil.exe`, and `Shell.Application`. This gives it several ways to continue if one download method fails.

T1059.005Visual BasicEvidence1

The second branch uses `Assessment_Order.vbs`. The script shows a tax assessment decoy image, downloads the same ClientSetup payload, writes a new `YTSysConfig.ini`, and runs the payload hidden.

T1204.002Malicious FileEvidence1

The chain does not rely on an exploit or a macro. It relies on the victim believing that the file is related to a tax assessment.

Persistence

3 techniques

T1112Modify RegistryEvidence1

Alert on UAC policy changes where `ConsentPromptBehaviorAdmin` is set to `0`. In this chain, the fake PNG/VBS stage changes local UAC behavior before the final agent installation.

T1543.003Windows ServiceEvidence1

MANC service is created for persistence. By creating a Windows service, the payload can start automatically and continue running after reboot.

T1547Boot or Logon Autostart ExecutionEvidence1

Two of the three branches end with a signed remote management client called ClientSetup, giving attackers persistent access to the infected machine.

Privilege Escalation

3 techniques

T1543.003Windows ServiceEvidence1

MANC service is created for persistence. By creating a Windows service, the payload can start automatically and continue running after reboot.

T1547Boot or Logon Autostart ExecutionEvidence1

Two of the three branches end with a signed remote management client called ClientSetup, giving attackers persistent access to the infected machine.

T1548.002Bypass User Account ControlEvidence1

The script lowers the local UAC prompt behavior by changing the following registry key: ConsentPromptBehaviorAdmin REG_DWORD 0x5 -> ConsentPromptBehaviorAdmin REG_DWORD 0x0

Stealth

3 techniques

T1036.005Match Legitimate Resource Name or LocationEvidence1

The VBS chain copies `curl.exe` and `bitsadmin.exe` into DLL-looking filenames such as `winhttp.dll` and `wininet.dll`... The ClientSetup branch runs a fake `svchost.exe` from the `msres` directory.

T1218System Binary Proxy ExecutionEvidence1

What makes this campaign hard to stop is that it abuses signed, legitimate-looking software rather than obvious malicious files.

T1218.007MsiexecEvidence1

It runs `msiexec.exe` with quiet-install options and passes the transform file and certificates from the same staging folder. The `/qn` flag is what makes the MSI installation quiet.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Alert on UAC policy changes where `ConsentPromptBehaviorAdmin` is set to `0`. In this chain, the fake PNG/VBS stage changes local UAC behavior before the final agent installation.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

Stronger behavioral signals include IP-addressed filenames, hidden directories under system folders, svchost.exe running from non-standard paths, and outbound traffic on ports 6671, 6681, and 6683.

T1071.001Web ProtocolsEvidence1

The downloader then reaches out to three hard-coded cloud-hosted objects... At this point, the chain has moved from a web-looking `.php` URL to a local staging directory and then into S3-hosted follow-on components.

T1105Ingress Tool TransferEvidence2

The script downloads `216.250.104.166ClientSetup.exe` from the same staging domain and executes it hidden... `1122.vbs` takes the next step: it brings down a complete agent installation bundle.

T1219Remote Access ToolsEvidence2

The third branch changes the payload strategy completely... it uses a PHP-named endpoint that returns VBScript, stages files through S3, changes UAC prompt behavior, and installs a signed ManageEngine UEMS agent.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app19 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

securonix blogNews

May 6, 2026

TAX#TRIDENT: Fake Indian Tax Lures Expand Across ZIP, VBS, and Signed Tool Delivery

A legitimate signed enterprise endpoint-management agent abused as the final payload. In this campaign it is silently installed via VBScript and MSI from a public staging directory, configured through DCAgentServerInfo.json to enroll to attacker-controlled infrastructure, and then used for durable remote management access.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

ManageEngine UEMS agent

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059.001PowerShellEvidence1

T1059.005Visual BasicEvidence1

The second branch uses `Assessment_Order.vbs`. The script shows a tax assessment decoy image, downloads the same ClientSetup payload, writes a new `YTSysConfig.ini`, and runs the payload hidden.

T1204.002Malicious FileEvidence1

The chain does not rely on an exploit or a macro. It relies on the victim believing that the file is related to a tax assessment.

Persistence

3 techniques

T1112Modify RegistryEvidence1

Alert on UAC policy changes where `ConsentPromptBehaviorAdmin` is set to `0`. In this chain, the fake PNG/VBS stage changes local UAC behavior before the final agent installation.

T1543.003Windows ServiceEvidence1

MANC service is created for persistence. By creating a Windows service, the payload can start automatically and continue running after reboot.

T1547Boot or Logon Autostart ExecutionEvidence1

Two of the three branches end with a signed remote management client called ClientSetup, giving attackers persistent access to the infected machine.

Privilege Escalation

3 techniques

T1543.003Windows ServiceEvidence1

MANC service is created for persistence. By creating a Windows service, the payload can start automatically and continue running after reboot.

T1547Boot or Logon Autostart ExecutionEvidence1

Two of the three branches end with a signed remote management client called ClientSetup, giving attackers persistent access to the infected machine.

T1548.002Bypass User Account ControlEvidence1

The script lowers the local UAC prompt behavior by changing the following registry key: ConsentPromptBehaviorAdmin REG_DWORD 0x5 -> ConsentPromptBehaviorAdmin REG_DWORD 0x0

Stealth

3 techniques

T1036.005Match Legitimate Resource Name or LocationEvidence1

The VBS chain copies `curl.exe` and `bitsadmin.exe` into DLL-looking filenames such as `winhttp.dll` and `wininet.dll`... The ClientSetup branch runs a fake `svchost.exe` from the `msres` directory.

T1218System Binary Proxy ExecutionEvidence1

What makes this campaign hard to stop is that it abuses signed, legitimate-looking software rather than obvious malicious files.

T1218.007MsiexecEvidence1

It runs `msiexec.exe` with quiet-install options and passes the transform file and certificates from the same staging folder. The `/qn` flag is what makes the MSI installation quiet.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Alert on UAC policy changes where `ConsentPromptBehaviorAdmin` is set to `0`. In this chain, the fake PNG/VBS stage changes local UAC behavior before the final agent installation.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

Stronger behavioral signals include IP-addressed filenames, hidden directories under system folders, svchost.exe running from non-standard paths, and outbound traffic on ports 6671, 6681, and 6683.

T1071.001Web ProtocolsEvidence1

T1105Ingress Tool TransferEvidence2

The script downloads `216.250.104.166ClientSetup.exe` from the same staging domain and executes it hidden... `1122.vbs` takes the next step: it brings down a complete agent installation bundle.

T1219Remote Access ToolsEvidence2

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app19 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

securonix blogNews

May 6, 2026

TAX#TRIDENT: Fake Indian Tax Lures Expand Across ZIP, VBS, and Signed Tool Delivery

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.