Loading story…
Researchers reported that the TAX#TRIDENT campaign is targeting Windows users in India with fake Income Tax assessment notices that lure victims into downloading malicious files. The operation relies on social engineering rather than software exploits and uses multiple delivery chains, including ZIP archives, VBScript downloaders, and a .php endpoint that actually serves VBScript. Across the campaign, attackers rotate domains, decoy documents, and payload delivery paths while keeping the same tax-themed lure, reducing the effectiveness of static blocklists and signature-based defenses.
Two infection chains deliver a signed ClientSetup payload linked to SyncFuture/Yangtu/YTSCRat-style tooling, creating a hidden msres directory, installing the MANC service and YtMiniFilter/ytdisk drivers, writing YTSysConfig data, and launching a fake svchost.exe that maintains communications over ports 6671, 6681, and 6683. A third chain abuses a legitimate ManageEngine UEMS agent, staging files in Public Documents, disguising copied LOLBins as DLLs, lowering UAC prompt behavior, silently installing UEMSAgent.msi, and enrolling infected hosts to attacker-controlled infrastructure at 202.61.160.201 over ports 8383 and 8027. Researchers said the tooling reflects abuse of China-linked commercial software but did not attribute the campaign to a specific threat actor, and urged defenders to prioritize behavioral indicators such as unusual svchost.exe paths, hidden system-folder directories, script engines executing web-style files, suspicious outbound ports, and unauthorized UAC policy changes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Securonix released a public report detailing persistence, drivers, hidden directories, fake svchost.exe execution, network communications, and UAC policy changes associated with TAX#TRIDENT. The researchers assessed the tooling as abuse of China-linked commercial software but did not attribute the campaign to a specific threat actor.
Securonix reported that the campaign used multiple delivery paths including ZIP archives, VBScript downloaders, and a PHP-named endpoint that actually served VBScript. Two chains delivered a signed ClientSetup remote-management payload, while a third installed a signed ManageEngine UEMS agent configured to communicate with attacker-controlled infrastructure.
An active campaign dubbed TAX#TRIDENT used fake Indian Income Tax assessment lures to socially engineer Windows users into downloading malicious files. The operation relied on tax-themed decoys rather than exploiting software vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcesecuronix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported an espionage-focused phishing operation dubbed **SyncFuture** targeting individuals in India by impersonating the country’s Income Tax Department. Victims were lured with urgent “tax penalty/compliance” notices (including distribution via *SendGrid* in some cases) that delivered a ZIP archive masquerading as a government document review tool; opening it launched a **multi-stage infection chain** designed to establish long-term access. Analysis attributed the discovery to eSentire’s Threat Response Unit, which documented the use of **DLL side-loading** with legitimate Microsoft-signed applications, privilege escalation via a **COM-based UAC bypass**, and process masquerading (e.g., appearing as `explorer.exe`) to reduce detection. The campaign also demonstrated notable defense evasion by abusing trusted software and user interaction: it leveraged **Microsoft-signed binaries** and ultimately deployed a legitimate enterprise management/security platform repurposed as the final payload for persistent remote control and surveillance, described as a commercial-grade **Chinese IT management tool** used for spying. Researchers also observed an unusual technique to evade *Avast Free Antivirus* by **simulating mouse movements and clicks** to navigate the product UI and disable/evade protections, underscoring a “living off trusted tools” approach rather than relying solely on custom malware components.
Jun 29, 2026
Attackers are impersonating India’s Income Tax Department in a phishing campaign that lures users to the fraudulent domain `harivo[.]vip` and prompts them to download a fake tax assessment archive. Researchers said the ZIP file leads to a staged infection chain involving a disk image and a .NET loader, ultimately executing `Tax_Assessment.exe` and `libsvcs.dll` to install a RAT-like payload on Windows systems while abusing trusted government branding to increase credibility. The malware uses **ConfuserEx** obfuscation, reflection-based DLL loading, and other defense-evasion techniques, and its behavior reportedly aligns closely with **XWorm**. Once launched, it establishes persistence, performs system reconnaissance and user monitoring, enables remote command execution, and communicates with a hardcoded command-and-control server at `103.231.12.27:4444` over encrypted channels, giving the threat actor sustained remote access; the infrastructure has been linked to a domain reportedly registered in September 2025, and researchers assess the operation as likely financially motivated.
Jun 29, 2026
A sophisticated phishing campaign has been uncovered targeting Indian organizations using income tax-themed lures. The attackers distribute emails with attachments that closely mimic official documents from the Indian Income Tax Department, enticing recipients to open malicious files. Technical analysis reveals that the campaign employs a Nullsoft Scriptable Install System (NSIS) installer to drop and execute payloads, ensuring persistence and reliability by leveraging temporary directories and custom working folders. The campaign's infrastructure includes the use of domains such as `ggwk[.]cc` and the delivery of executables like "tax affairs.exe" to compromise victims. Attribution analysis by CloudSEK indicates that this campaign is linked to a Chinese APT group, contradicting previous misattributions to India-aligned actors such as SideWinder. The attackers' tactics, techniques, and procedures (TTPs) demonstrate a sophisticated kill chain, with the phishing lures and payload delivery mechanisms designed to evade detection and maximize the likelihood of successful compromise. Accurate attribution is emphasized as critical for effective defense, as misattribution can lead to misdirected security efforts and allow the true adversary to operate undetected.
Jun 29, 2026