Operation DragonReturn: China-linked cyber espionage campaign targets India's tax infrastructure with multi-stage DcRAT malware
By
Seqrite
Summary
Seqrite's report on Operation DragonReturn reveals a China-aligned cyber espionage campaign targeting India's Income Tax Department infrastructure. The operation impersonates the tax authority to target taxpayers, tax professionals, and corporate finance teams using a multi-stage malware chain called DcRAT. Key techniques include a fake ITR utility as the initial lure, steganographic payload concealment (hiding malware in images), AMSI bypass to evade detection, Windows service persistence, and encrypted command-and-control infrastructure (govtop[.]one, kkxqbh[.]). The campaign is specifically aimed at compromising government tax systems and stealing sensitive financial data.
Source
bskyOperation DragonReturn: China-linked cyber espionage campaign targets India's tax infrastructure with multi-stage DcRAT malwarehendryadrian.comKey quotes
· 2 pulledSeqrite reported Operation DragonReturn, a China-aligned campaign that impersonates India's Income Tax Department to target taxpayers, tax professionals, and corporate finance teams with a multi-stage malware chain.
The operation uses a fake ITR utility, steganographic payload concealment, AMSI bypass, Windows service persistence, and encrypted C2 infrastructure including govtop[.]one, kkxqbh[.]
You might also wanna read
Justice Department Takes Coordinated Action Against North Korean IT Worker Revenue Schemes
The U.S. Justice Department announced coordinated nationwide actions against North Korean government schemes using remote IT workers to gene
justice.gov·9mo ago
Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks
FBI official says China's Salt Typhoon espionage campaign likely compromised data of nearly every American
An FBI cyber official stated that China's Salt Typhoon espionage campaign has likely stolen information from nearly every American through y
theregister.com·10mo ago
China-Based Phishing Groups Shift to Fake E-commerce Sites and Tax Refund Scams
China-based phishing groups are shifting tactics from traditional SMS scams about packages and toll fees to new offerings targeting holiday
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure
Investigation: Foreign-Linked Political Group Campaigns Against American AI Data Centers Across 14 States
A Bitcoin Policy Institute investigation into how the Party for Socialism and Liberation (PSL), the political arm of Shanghai-based Marxist
.png)
btcpolicy.org·5d ago
Comments
Sign in to join the conversation.
No comments yet. Be the first.