Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT
Summary: Seqrite Labs documented a campaign it calls Operation DragonReturn, first observed on May 18, 2026, in which spear-phishing emails impersonating India's Income Tax Department use tax-violation and penalty lures in PDF attachments to send targets to a fake filing-utility download that side-loads a malicious DLL and delivers DCRat. The chain hides a 504 KB DLL inside a JPG image, copies itself as 'Mixed Reality.exe,' and creates an auto-start Windows service named MixedSvc, while infrastructure analysis points to ChinaNet IP addresses, a Chinese-language web panel, and overlaps with the Silver Fox group. Cyderes separately detailed an identical chain using fake Income Tax Department websites, noting the campaign runs two implants over separate command-and-control channels so that blocking one leaves the other active.
What you should know: The dual-implant design means catching one backdoor does not end the intrusion - the second implant keeps its own C2 channel and detection profile, so a single block leaves an attacker resident on the host. The campaign was timed to India's filing season and aimed at taxpayers, tax professionals, and corporate finance teams, the people who handle exactly the financial and credential data the operators are after.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026