hacker-news · Crawled Jul 6, 2026
Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT
7 IoCs 1 Actors 2 Malware
Read original article ↗
AI Summary
A suspected China-nexus threat actor is conducting a targeted cyber espionage campaign against Indian taxpayers, tax professionals, and corporate finance teams using spear-phishing emails impersonating the Indian Income Tax Department. The campaign, dubbed Operation DragonReturn, delivers DcRAT via a malicious fake tax filing utility to steal sensitive data and establish persistent access. The attackers use social engineering, DLL side-loading, image-based payload concealment, and Windows service persistence to maintain long-term access to compromised systems.
AI-extracted · verify before operational use
Extracted Entities 3 found
Indicators of Compromise 7 extracted
MITRE ATT&CK TTPs 53 techniques
T1012 Query Registry · Discovery T1027 Obfuscated Files or Information · Defense Evasion T1036 Masquerading · Defense Evasion T1053.003 Cron · Execution T1055 Process Injection · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1190 Exploit Public-Facing Application · Initial Access T1204.002 Malicious File · Execution T1566 Phishing · Initial Access T1570 Lateral Tool Transfer · Lateral Movement T1583 Acquire Infrastructure · Resource Development T1584 Compromise Infrastructure · Resource Development T1586 Compromise Accounts · Resource Development T1006 Direct Volume Access · Defense Evasion T1014 Rootkit · Defense Evasion T1036.005 Match Legitimate Name or Location · Defense Evasion T1053 Scheduled Task/Job · Execution T1053.005 Scheduled Task · Execution T1055.005 Thread Local Storage · Defense Evasion T1055.015 ListPlanting · Defense Evasion T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1078 Valid Accounts · Defense Evasion T1089 T1089 T1112 Modify Registry · Defense Evasion T1129 Shared Modules · Execution T1132.001 Standard Encoding · Command And Control T1134.001 Token Impersonation/Theft · Defense Evasion T1136 Create Account · Persistence T1176 Browser Extensions · Persistence T1484.002 Trust Modification · Defense Evasion T1543.001 Launch Agent · Persistence T1548.002 Bypass User Account Control · Privilege Escalation T1574.002 DLL Side-Loading · Persistence T1005 Data from Local System · Collection T1021 Remote Services · Lateral Movement T1021.006 Windows Remote Management · Lateral Movement T1055.012 Process Hollowing · Defense Evasion T1070.003 Clear Command History · Defense Evasion T1071 Application Layer Protocol · Command And Control T1085 T1085 T1113 Screen Capture · Collection T1133 External Remote Services · Persistence T1213 Data from Information Repositories · Collection T1213.001 Confluence · Collection T1548 Abuse Elevation Control Mechanism · Privilege Escalation T1566.001 Spearphishing Attachment · Initial Access