Do Son 
Seqrite Labs recently identified a malware distribution campaign that abused the credibility of government institutions to increase infection success rates. Attackers launched a GST phishing campaign targeting Indian businesses. They disguised malicious emails as official taxation notifications. Consequently, victims interacted with attached archives out of urgency. This activity highlights the continued threat of government-themed social engineering. Furthermore, the attackers deployed the dangerous Remcos RAT malware to steal sensitive data. Industry experts warn that these financial lures remain highly successful against corporate targets.
At a glance
- Malware Family: Remcos RAT, custom .NET loaders
- Threat Actor: Suspected India-focused cybercrime operator or Initial Access Broker (Unconfirmed)
- Target or Victims: Indian businesses and taxpayers
- Delivery Vector: Spear phishing emails with RAR attachments
- Key Capabilities: Fileless execution, bitmap payload concealment, privilege escalation via trusted binaries
- Source: Seqrite Labs
TL;DR
A malicious operation targets taxpayers using fake tax refund emails. These messages contain an executable hidden inside an archive file. Ultimately, the attack chain deploys remote access malware to steal corporate data and monitor user activity.
Delivery
The attackers spoofed the Government of India tax infrastructure to distribute their emails. Messages originated from a fake official address and carried a subject line about a refund application. To enhance credibility, the email referenced a specific application number.
The message included an attached archive file. This file shared the exact application number in its name. Therefore, the matching identifiers reinforced the illusion of a legitimate document. The primary objective of the campaign appears to be malware deployment and the theft of sensitive information.
Infection chain
Once a user opens the archive, they expose a Microsoft .NET executable. This executable masquerades as a standard tax document. However, it contains an embedded bitmap image in its resources. The malware hides its next stage inside this image. It reads the color values of individual pixels to reconstruct a binary file.
Next, the program loads a hidden DLL directly into memory. This fileless execution technique helps the malware evade traditional antivirus scans. A second-stage loader then decrypts another payload using an XOR operation. This step reveals a file called PerfGuard.dll.
Following decryption, the malware checks the system architecture. It runs specific methods based on whether the host is 32-bit or 64-bit. The loader also checks for administrative privileges. If it lacks them, it abuses a trusted system binary to elevate its access. For a deeper understanding of this process, read the complete analysis on the GST phishing infection chain.
To maintain access, the malware copies itself to a hidden application folder. It creates a PowerShell script to run this copy silently. Finally, it modifies the Windows registry to run the script upon user login.
Command-and-control and data-exfiltration behaviour
The final stage decrypts and launches the remote access trojan entirely in memory. This tool connects to attacker-controlled infrastructure using dynamic DNS services. The use of dynamic DNS services is consistent with commodity malware operations and financially motivated cybercrime.
Once connected, the trojan provides the attacker with total system control. It enables remote command execution and file management. Furthermore, the malware records keystrokes and harvests user credentials. It can capture desktop screenshots and monitor user activity in real time.
The attackers can also deploy additional payloads to the compromised machine. They route their traffic through rotating servers hosted in Europe. This setup makes tracing the operators extremely difficult.
Defense or detection guidance
Organizations must train employees to identify suspicious tax-related communications. Users should verify unexpected refund notices directly through official government portals. Never open executable files contained within unsolicited email attachments.
Security teams should monitor their networks for unusual child processes spawning from trusted binaries. Defenders must restrict standard users from modifying registry run keys. In addition, administrators should implement strict email filtering rules to block executable file types.
Endpoint protection tools must scan memory for fileless execution anomalies. Finally, block traffic to known malicious dynamic DNS providers to disrupt control channels. By taking these steps, companies can protect their networks from similar attacks.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
