TAX#TRIDENT Uses Fake Indian Tax Notices to Deploy Signed Remote Access Tools

Researchers reported that the TAX#TRIDENT campaign is targeting Windows users in India with fake Income Tax assessment notices that lure victims into downloading malicious files. The operation relies on social engineering rather than software exploits and uses multiple delivery chains, including ZIP archives, VBScript downloaders, and a .php endpoint that actually serves VBScript. Across the campaign, attackers rotate domains, decoy documents, and payload delivery paths while keeping the same tax-themed lure, reducing the effectiveness of static blocklists and signature-based defenses.

Two infection chains deliver a signed ClientSetup payload linked to SyncFuture/Yangtu/YTSCRat-style tooling, creating a hidden msres directory, installing the MANC service and YtMiniFilter/ytdisk drivers, writing YTSysConfig data, and launching a fake svchost.exe that maintains communications over ports 6671, 6681, and 6683. A third chain abuses a legitimate ManageEngine UEMS agent, staging files in Public Documents, disguising copied LOLBins as DLLs, lowering UAC prompt behavior, silently installing UEMSAgent.msi, and enrolling infected hosts to attacker-controlled infrastructure at 202.61.160.201 over ports 8383 and 8027. Researchers said the tooling reflects abuse of China-linked commercial software but did not attribute the campaign to a specific threat actor, and urged defenders to prioritize behavioral indicators such as unusual svchost.exe paths, hidden system-folder directories, script engines executing web-style files, suspicious outbound ports, and unauthorized UAC policy changes.