Do Son 
At a glance
- Actor or group: PAPERMILL (suspected Silver Fox-adjacent cluster)
- Activity type: Tax-themed phishing, DLL sideloading, and remote access trojan deployment
- Targets or victims: Enterprise organizations, with a focus on Indian entities
- Scale: Multiple concurrent campaigns using automated payload generators
- Jurisdiction or law-enforcement status: Active China-nexus cybercrime operation under ongoing research
- Source: JUMPSEC Detection and Response Team (DART)
TL;DR
The PAPERMILL cybercrime cluster distributes malicious disk images masquerading as official tax documents. Attackers abuse legitimate signed software to sideload encrypted loaders and execute VenomRAT in system memory. Organizations must tighten controls on virtual disk mounting to prevent these intrusions.
What Happened
The attack begins when a victim receives a phishing email regarding an urgent tax notice. The message delivers an optical disk image bearing an .img extension. Attackers choose this container format for a specific technical reason. Windows automatically mounts ISO images as virtual drives when opened. Files inside mounted disk images do not inherit the Mark-of-the-Web. Therefore, Windows SmartScreen and web download warnings do not trigger.
The disk container holds three files. These include an executable, a malicious library, and an encrypted data payload. The executable file is a legitimate, digitally signed Notepad++ application. Attackers did not alter this binary. Instead, they renamed it to mimic an official tax assessment document. When executed, Notepad++ automatically searches its local directory for libcurl.dll.
The threat actors planted a custom library matching the exact export functions expected by Notepad++. This classic DLL sideloading technique allows the malicious loader to execute while the host application appears normal. Furthermore, the loader obfuscates its internal structure. The author swapped section names in the file header. For example, executable instructions reside in a section named .nvdata to confuse security analysts.
The loader also conducts several environment checks to detect virtual machines. It measures processor cores, physical memory, system uptime, and mouse movements. If a check fails, the loader does not terminate. The report observes: “Rather than fighting the sandbox, it simply waits it out.” The process sleeps for five minutes to outlast automated analysis windows before resuming execution.
Next, the loader decrypts the encrypted payload file. It applies bitwise operations, a shuffle routine, and RC4 encryption. This step unpacks Donut shellcode into memory. The shellcode then reflectively loads a .NET binary containing VenomRAT. The remote access trojan provides hidden desktop control, keystroke logging, and credential theft capabilities.
Who Is Behind It
JUMPSEC attributes this activity with moderate-to-high confidence to a China-nexus threat cluster. Analysts named the operation PAPERMILL because operators use public builders to churn out new payloads.
The campaign shares notable behavioral overlaps with Silver Fox, an established China-nexus cybercrime syndicate. Silver Fox frequently targets accounting departments using regional tax lures. However, the specific tooling differs from historical Silver Fox operations. Typical Silver Fox attacks abuse download utilities, while PAPERMILL sideloads through Notepad++. Additionally, Silver Fox commonly deploys ValleyRAT rather than VenomRAT.
The report notes: “The class of activity is a Silver Fox family fingerprint, but the specific implementation is a variant, not a repetition.” The threat actors maintain infrastructure connected to Chinese internet service providers with records dating back to 2021. Analysts suggest the group may represent a splinter cell or a separate crew using shared Chinese crimeware.
Impact or Scale
The PAPERMILL cybercrime cluster targets corporate entities, particularly organizations located in India. By pivoting on command servers, researchers identified several related disk images referencing Indian tax authorities.
Once installed, VenomRAT grants operators complete control over compromised machines. Attackers can view screens through hidden virtual desktop sessions without user knowledge. Intruders can also extract stored browser passwords and drain cryptocurrency wallets. Furthermore, timestamps indicate that the operators generate disk images dynamically for each download. This dynamic creation produces unique file hashes for every victim, frustrating traditional hash-based detection tools.
What Comes Next or How Readers Can Stay Protected
The appearance of the new PAPERMILL cybercrime cluster demonstrates how threat actors adapt commodity tools to evade enterprise defenses. Security teams must adjust detection strategies beyond simple file signatures.
Organizations should block incoming emails containing disk image attachments, including ISO and IMG files. System administrators can also disable virtual disk mounting on standard employee workstations via group policy. Furthermore, endpoint detection systems should monitor trusted software directories for unexpected DLL loading events. Security teams must configure alerts for unsigned libraries residing alongside signed administrative utilities. Finally, companies should train staff to verify unexpected financial notifications through official communication channels.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
