Chinese APT-Linked Tax-Themed Phishing Campaign Targeting India

A sophisticated phishing campaign has been uncovered targeting Indian organizations using income tax-themed lures. The attackers distribute emails with attachments that closely mimic official documents from the Indian Income Tax Department, enticing recipients to open malicious files. Technical analysis reveals that the campaign employs a Nullsoft Scriptable Install System (NSIS) installer to drop and execute payloads, ensuring persistence and reliability by leveraging temporary directories and custom working folders. The campaign's infrastructure includes the use of domains such as ggwk[.]cc and the delivery of executables like "tax affairs.exe" to compromise victims.

Attribution analysis by CloudSEK indicates that this campaign is linked to a Chinese APT group, contradicting previous misattributions to India-aligned actors such as SideWinder. The attackers' tactics, techniques, and procedures (TTPs) demonstrate a sophisticated kill chain, with the phishing lures and payload delivery mechanisms designed to evade detection and maximize the likelihood of successful compromise. Accurate attribution is emphasized as critical for effective defense, as misattribution can lead to misdirected security efforts and allow the true adversary to operate undetected.