Loading story…
A sophisticated phishing campaign has been uncovered targeting Indian organizations using income tax-themed lures. The attackers distribute emails with attachments that closely mimic official documents from the Indian Income Tax Department, enticing recipients to open malicious files. Technical analysis reveals that the campaign employs a Nullsoft Scriptable Install System (NSIS) installer to drop and execute payloads, ensuring persistence and reliability by leveraging temporary directories and custom working folders. The campaign's infrastructure includes the use of domains such as ggwk[.]cc and the delivery of executables like "tax affairs.exe" to compromise victims.
Attribution analysis by CloudSEK indicates that this campaign is linked to a Chinese APT group, contradicting previous misattributions to India-aligned actors such as SideWinder. The attackers' tactics, techniques, and procedures (TTPs) demonstrate a sophisticated kill chain, with the phishing lures and payload delivery mechanisms designed to evade detection and maximize the likelihood of successful compromise. Accurate attribution is emphasized as critical for effective defense, as misattribution can lead to misdirected security efforts and allow the true adversary to operate undetected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Analysis of the malware used in the campaign linked it to China-associated threat activity, including Valley RAT delivered through a Donut-based loader and process hollowing. Researchers documented rotating command-and-control infrastructure, registry-based persistence, and plugin injection into signed Windows utilities.
Attackers launched a phishing campaign impersonating the Indian Income Tax Department and using a "Tax Compliance" lure to trick victims into downloading malware. The activity targeted Indian organizations and individuals with government-themed social engineering.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated phishing campaign targeting Indian entities has been attributed to the SideWinder advanced persistent threat group. Attackers impersonate the Indian Income Tax Department by sending tax-themed emails that urge recipients to review an inspection document. These emails contain links to a fake tax portal closely mimicking the legitimate government site, which then delivers a malicious ZIP archive. The archive includes a renamed, signed Microsoft Defender binary and a malicious DLL, exploiting DLL side-loading to install a Windows backdoor. The malware performs geofencing by checking the victim's timezone and only proceeds if it matches South Asian regions, thereby targeting Indian organizations specifically. Once installed, the backdoor enables file theft, data capture, and remote control by the attackers, with connections observed to known SideWinder command-and-control servers. Security researchers have noted a surge in tax-themed phishing and malware campaigns during the Indian tax filing season, leveraging public discussions about refunds to increase credibility. The spear-phishing emails often originate from suspicious domains and use embedded images to bypass spam filters, further enhancing their effectiveness. The infection chain is multi-stage, ultimately deploying persistent remote access trojans or infostealers. These campaigns highlight the evolving tactics of threat actors in targeting Indian businesses and government-related entities through highly convincing social engineering and technical subterfuge.
Jun 29, 2026
Researchers reported a suspected China-linked phishing campaign targeting Indian taxpayers, tax professionals, and corporate finance teams by impersonating the **Income Tax Department of India**. The operation, tracked as **Operation DragonReturn**, used tax-themed emails to lure victims into opening malicious archives and virtual disk files that triggered multi-stage infections through **DLL side-loading** and hijacking. Observed activity began in mid-May, and investigators said the infrastructure and tradecraft show overlaps with the China-associated group **Silver Fox**. The malware chains ultimately deployed remote access trojans including **DCRat** and **ValleyRat**, along with secondary payloads for screenshots and data exfiltration. Researchers said the intrusions relied on anti-analysis checks, **UAC** elevation, image-based payload concealment, encrypted in-memory execution, **AMSI** bypass, process injection, and persistence via Windows services and the registry. The implants were also capable of downloading additional encrypted modules from command-and-control servers, giving attackers covert, persistent access to victim systems.
Jul 8, 2026
Attackers are impersonating India’s Income Tax Department in a phishing campaign that lures users to the fraudulent domain `harivo[.]vip` and prompts them to download a fake tax assessment archive. Researchers said the ZIP file leads to a staged infection chain involving a disk image and a .NET loader, ultimately executing `Tax_Assessment.exe` and `libsvcs.dll` to install a RAT-like payload on Windows systems while abusing trusted government branding to increase credibility. The malware uses **ConfuserEx** obfuscation, reflection-based DLL loading, and other defense-evasion techniques, and its behavior reportedly aligns closely with **XWorm**. Once launched, it establishes persistence, performs system reconnaissance and user monitoring, enables remote command execution, and communicates with a hardcoded command-and-control server at `103.231.12.27:4444` over encrypted channels, giving the threat actor sustained remote access; the infrastructure has been linked to a domain reportedly registered in September 2025, and researchers assess the operation as likely financially motivated.
Jun 29, 2026