hacker-news Jul 6, 2026 · Crawled Jul 6, 2026

Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

7 IoCs 1 Actors 2 Malware

AI Summary

A suspected China-nexus threat actor is conducting a targeted cyber espionage campaign against Indian taxpayers, tax professionals, and corporate finance teams using spear-phishing emails impersonating the Indian Income Tax Department. The campaign, dubbed Operation DragonReturn, delivers DcRAT via a malicious fake tax filing utility to steal sensitive data and establish persistent access. The attackers use social engineering, DLL side-loading, image-based payload concealment, and Windows service persistence to maintain long-term access to compromised systems.

AI-extracted · verify before operational use

Extracted Entities 3 found

Malware DCRat → Malware ValleyRAT → Threat Actor Void Arachne →

Indicators of Compromise 7 extracted

Type	Value	Detail
Domain	govtop[[.]]one	Details →
Domain	kkxqbh[[.]]top	Details →
IP	204[.]194[.]48[.]250	Details →
IP	223[.]26[.]63[.]40	Details →
Filename	nvdaHelperRemote.dll	Details →
Filename	lllyd.jpg	Details →
Filename	Mixed Reality.exe	Details →

MITRE ATT&CK TTPs 34 techniques

T1012 Query Registry · Discovery T1027 Obfuscated Files or Information · Defense Evasion T1036 Masquerading · Defense Evasion T1053.003 Cron · Execution T1055 Process Injection · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1204.002 Malicious File · Execution T1566 Phishing · Initial Access T1006 Direct Volume Access · Defense Evasion T1014 Rootkit · Defense Evasion T1053.005 Scheduled Task · Execution T1055.015 ListPlanting · Defense Evasion T1059.001 PowerShell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1548.002 Bypass User Account Control · Privilege Escalation T1005 Data from Local System · Collection T1021 Remote Services · Lateral Movement T1021.006 Windows Remote Management · Lateral Movement T1055.012 Process Hollowing · Defense Evasion T1070.003 Clear Command History · Defense Evasion T1071 Application Layer Protocol · Command And Control T1085 T1085 T1113 Screen Capture · Collection T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1213 Data from Information Repositories · Collection T1213.001 Confluence · Collection T1543.001 Launch Agent · Persistence T1548 Abuse Elevation Control Mechanism · Privilege Escalation T1566.001 Spearphishing Attachment · Initial Access