Loading story…
Researchers reported a suspected China-linked phishing campaign targeting Indian taxpayers, tax professionals, and corporate finance teams by impersonating the Income Tax Department of India. The operation, tracked as Operation DragonReturn, used tax-themed emails to lure victims into opening malicious archives and virtual disk files that triggered multi-stage infections through DLL side-loading and hijacking. Observed activity began in mid-May, and investigators said the infrastructure and tradecraft show overlaps with the China-associated group Silver Fox.
The malware chains ultimately deployed remote access trojans including DCRat and ValleyRat, along with secondary payloads for screenshots and data exfiltration. Researchers said the intrusions relied on anti-analysis checks, UAC elevation, image-based payload concealment, encrypted in-memory execution, AMSI bypass, process injection, and persistence via Windows services and the registry. The implants were also capable of downloading additional encrypted modules from command-and-control servers, giving attackers covert, persistent access to victim systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Cyderes detailed a six-stage infection chain in the fake Indian tax notice campaign that ultimately injects two implants into svchost.exe: a Gh0st RAT derivative and a Quasar/AsyncRAT-family .NET implant. The report also identified command-and-control endpoints kkxqbh[.]top:6666 and ouewop[.]com:6351, along with AMSI patching, in-memory CLR hosting, and session-aware process injection.
Researchers reported a social engineering campaign impersonating the Indian Income Tax Department and using DLL side-loading and multi-stage execution to deploy remote access trojans. Across reporting, the activity was linked to suspected China-nexus operators, with one analysis noting overlaps suggesting possible ties to Silver Fox.
Seqrite Labs observed a suspected China-nexus campaign targeting Indian taxpayers, tax professionals, and corporate finance teams beginning on May 18, 2026. The operation used spear-phishing emails impersonating the Income Tax Department of India to deliver malware via a fake tax filing utility.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcecommunity.gurucul.com
Open sourcecyderes.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A China-nexus espionage campaign dubbed **Operation DragonReturn** has targeted India’s tax ecosystem by impersonating the Income Tax Department and distributing a fake filing utility during the `AY2026-27` tax season. Researchers said the operation used a lure hosted at `govtop[.]one/incometax` to deliver a ZIP archive posing as `Common_Offline_Utility_ITR-1_to_4_AY2026-27.zip`, aiming at taxpayers, tax professionals, corporate finance teams, and government-linked tax infrastructure. Seqrite and Gurucul assessed the activity with medium-to-high confidence as aligned with a China-linked cluster based on infrastructure overlaps, Chinese-language artifacts, and tradecraft similarities to RAT-focused espionage operations active across Asia. The infection chain deployed **DcRAT** through multiple stages, using image-based payload concealment in `background.jpg`, process injection into `svchost.exe`, AMSI bypass, and fileless execution of a decrypted .NET assembly in memory. Persistence was established through a Windows service named **MixedSvc** masquerading as “Windows Mixed Reality Service,” while command-and-control traffic was observed over encrypted TLS to `223.26.63.40:2671`, with related infrastructure tied to `kkxqbh[.]top`, `1kkkkddd.com`, and additional domains, IPs, and SHA-256 indicators published by Gurucul. Researchers said the operators rotated payloads every 7–10 days, and at least one variant initially showed `0/66` detections on VirusTotal, underscoring the campaign’s emphasis on stealth and intelligence collection.
Jun 29, 2026
The Chinese threat actor known as **Silver Fox** has launched a targeted phishing campaign against Indian organizations, using income tax-themed emails to deliver the modular remote access trojan **ValleyRAT**. Attackers impersonate the Indian Income Tax Department, sending emails with decoy PDF attachments that, when opened, direct victims to a malicious website hosting a ZIP archive. This archive contains a disguised installer that leverages DLL hijacking, specifically abusing a legitimate executable (`thunder.exe`) and a malicious DLL (`libexpat.dll`), to establish persistent access and evade detection. The campaign demonstrates a sophisticated multi-stage infection chain, with the initial payload acting as a loader for subsequent malware modules designed to maintain deep access to compromised systems. Researchers from CloudSEK have attributed this campaign to Silver Fox, correcting previous misattributions to other threat groups. The group, also known as SwimSnake and Void Arachne, has expanded its targeting beyond Chinese-speaking entities to include Indian public, financial, medical, and technology sectors. The use of socially engineered tax documents and trusted file formats highlights the attackers' ability to bypass traditional security controls, while the complex kill chain and modular malware architecture underscore the evolving threat posed by Silver Fox to Indian organizations.
Jun 29, 2026
Attackers are impersonating India’s Income Tax Department in a phishing campaign that lures users to the fraudulent domain `harivo[.]vip` and prompts them to download a fake tax assessment archive. Researchers said the ZIP file leads to a staged infection chain involving a disk image and a .NET loader, ultimately executing `Tax_Assessment.exe` and `libsvcs.dll` to install a RAT-like payload on Windows systems while abusing trusted government branding to increase credibility. The malware uses **ConfuserEx** obfuscation, reflection-based DLL loading, and other defense-evasion techniques, and its behavior reportedly aligns closely with **XWorm**. Once launched, it establishes persistence, performs system reconnaissance and user monitoring, enables remote command execution, and communicates with a hardcoded command-and-control server at `103.231.12.27:4444` over encrypted channels, giving the threat actor sustained remote access; the infrastructure has been linked to a domain reportedly registered in September 2025, and researchers assess the operation as likely financially motivated.
Jun 29, 2026