Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT 疑似中国关联黑客利用虚假印度税务申报工具部署DcRAT

TL;DR

• A China-nexus threat actor, linked to the Silver Fox group, is conducting spear-phishing campaigns against Indian taxpayers using fake Income Tax Department utilities to deploy the DCRAT remote access trojan.
• The attack chain utilizes sophisticated social engineering, including bilingual lures and legal citations, followed by DLL sideloading and image-based payload concealment to evade detection and establish persistence via Windows services.
• Infrastructure analysis reveals the use of ChinaNet IPs and a Chinese-language C2 panel, indicating a coordinated effort focused on financial gain and sensitive data exfiltration from the Indian taxpayer ecosystem.
• Concurrently, similar tactics involving fake installers and DLL sideloading are being used to distribute ValleyRAT to Chinese- and Japanese-speaking users, suggesting broader regional targeting by aligned threat actors.

Why It Matters

This incident highlights the increasing sophistication of nation-state-aligned cybercriminal groups leveraging highly localized social engineering to target specific professional demographics, such as tax professionals, for high-value data theft. For AI and cybersecurity practitioners, it underscores the critical need for advanced behavioral analytics and context-aware phishing detection systems that can identify nuanced linguistic cues and legitimate-looking but malicious document structures. Furthermore, the convergence of tactics between different RAT families (DCRAT and ValleyRAT) suggests a shared toolkit or infrastructure among East Asian threat actors, necessitating updated threat intelligence sharing and defensive strategies.

Technical Details

• Attack Vector: Spear-phishing emails impersonating the Indian Income Tax Department, utilizing PDF attachments with malicious links to fake tax filing utilities.
• Payload Delivery: Uses DLL sideloading with nvdaHelperRemote.dll to inject code into memory, bypassing standard executable execution controls.
• Evasion Techniques: Employs anti-sandbox checks, UAC prompt manipulation to gain administrative privileges, and hides secondary payloads within JPG images stored in system directories.
• Persistence and Execution: Deploys Mixed Reality.exe which creates a Windows service (MixedSvc) for boot persistence, disables AMSI scanning, and loads DCRAT or ValleyRAT for remote access and data exfiltration.
• Infrastructure: Command and control servers utilize IP addresses associated with ChinaNet and feature Chinese-language management panels, linking the activity to known groups like Silver Fox and potentially REF3864.

Industry Insight

Organizations handling sensitive financial data in India should immediately audit their email security gateways for impersonation attempts related to government tax departments and enforce strict policies against downloading executables from unverified sources. Security teams should update detection signatures to identify the specific DLL sideloading patterns and image-based payload concealment techniques described in this campaign. Additionally, cross-border threat intelligence sharing regarding the overlap between DCRAT and ValleyRAT infrastructure could help preemptively block future campaigns targeting other regions in Asia.

TL;DR

• 疑似中国关联黑客组织利用伪造的印度税务申报工具发起“Operation DragonReturn”网络攻击，目标锁定印度纳税人及企业财务团队。
• 攻击链条通过钓鱼邮件诱导下载ZIP包，利用恶意DLL侧加载技术提取隐藏在JPG图片中的DCRAT远程访问木马，并建立持久化驻留。
• 基础设施分析显示使用了ChinaNet IP地址及中文管理面板，战术特征与之前归因于中国的Silver Fox团伙高度重合。
• 同期LevelBlue还检测到针对中日用户的ValleyRAT分发活动，采用虚假LINE安装器和薪资调整钓鱼邮件，进一步印证了针对亚洲特定区域的定向攻击趋势。

为什么值得看

本文揭示了针对特定行业（税务/金融）和地域（印度）的高级持续性威胁（APT）手法，展示了攻击者如何利用社会工程学结合复杂的免杀技术（如图片隐藏载荷、DLL侧加载）来规避检测。对于安全从业者而言，理解此类多阶段攻击链及TTPs（战术、技术和过程）有助于优化威胁情报监控和端点防御策略。

技术解析

• 初始访问与社会工程学：攻击者发送伪装成印度所得税部门的钓鱼邮件，利用真实的法律引用和双语内容制造紧迫感，诱导用户点击嵌入在PDF中的恶意链接（govtop[.]one/incometax）。
• 载荷投递与隐蔽机制：受害者下载ZIP包后，执行看似合法的离线税务工具，实则触发恶意DLL（nvdaHelperRemote.dll）侧加载。该DLL注入内存后，从硬编码服务器（204.194.48[.]250）下载JPG图片（lllyd.jpg），并将其保存为C:\Windows\background.jpg，利用图像文件作为二次载荷的容器。
• 持久化与权限提升：主程序Mixed Reality.exe通过创建名为MixedSvc的Windows服务实现开机自启持久化，并尝试获取管理员权限以绕过UAC。同时，它禁用Windows AMSI扫描以逃避内存检测。
• 恶意软件功能：最终部署的是DCRAT（DcRAT），具备屏幕截图、数据外泄（发送至kkxqbh[.]top）及凭证窃取能力。此外，文章提及另一相关活动使用ValleyRAT，并通过PoolParty Variant 7技术将shellcode注入explorer.exe进程。

行业启示

• 针对性钓鱼攻击的精细化：攻击者不再依赖广撒网，而是针对特定职业群体（如税务人员）定制高逼真度的诱饵文档，包括使用真实法律条文和本地化语言，企业需加强对员工的社会工程学意识培训，特别是针对财务和法务部门。
• 防御DLL侧加载与异常进程行为：传统的基于签名的检测难以应对此类利用合法系统组件（如explorer.exe）或隐藏载荷的技术。建议部署基于行为的EDR解决方案，监控异常的DLL加载路径、内存注入行为以及非标准进程间的通信。
• 威胁情报共享与区域联动：不同安全厂商（Seqrite, LevelBlue, Cybereason）观察到的攻击虽针对不同地区，但使用了相似的RAT变种（ValleyRAT, DCRAT）和基础设施重叠。这表明跨国网络犯罪团伙存在资源共享和技术复用，加强跨机构的情报共享对于早期预警至关重要。