state-sponsored-espionagephishing-campaign-intelligenceremote-access-implantgovernment-diplomatic-threat

Operation DragonReturn Deploys DcRAT Against India’s Tax Infrastructure

Threat Actor Intelligence · 4 sources · Updated 4mo ago · First seen Jun 19, 2026

A China-nexus espionage campaign dubbed Operation DragonReturn has targeted India’s tax ecosystem by impersonating the Income Tax Department and distributing a fake filing utility during the AY2026-27 tax season. Researchers said the operation used a lure hosted at govtop[.]one/incometax to deliver a ZIP archive posing as Common_Offline_Utility_ITR-1_to_4_AY2026-27.zip, aiming at taxpayers, tax professionals, corporate finance teams, and government-linked tax infrastructure. Seqrite and Gurucul assessed the activity with medium-to-high confidence as aligned with a China-linked cluster based on infrastructure overlaps, Chinese-language artifacts, and tradecraft similarities to RAT-focused espionage operations active across Asia.

The infection chain deployed DcRAT through multiple stages, using image-based payload concealment in background.jpg, process injection into svchost.exe, AMSI bypass, and fileless execution of a decrypted .NET assembly in memory. Persistence was established through a Windows service named MixedSvc masquerading as “Windows Mixed Reality Service,” while command-and-control traffic was observed over encrypted TLS to 223.26.63.40:2671, with related infrastructure tied to kkxqbh[.]top, 1kkkkddd.com, and additional domains, IPs, and SHA-256 indicators published by Gurucul. Researchers said the operators rotated payloads every 7–10 days, and at least one variant initially showed 0/66 detections on VirusTotal, underscoring the campaign’s emphasis on stealth and intelligence collection.

Know this adversaryTTPs, infrastructure, and targeting history in one profile.

Get the profile

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Apr 7, 2026 – Jun 29, 2026

Jun 29, 20264mo ago
Gurucul publishes DragonReturn IOCs and detection guidance
Gurucul published additional reporting on Operation DragonReturn, describing it as a high-severity China-nexus cyber-espionage campaign targeting India’s tax infrastructure. The content included indicators of compromise such as domains, IP addresses, SHA-256 hashes, and example detection queries.
Operation DragonReturn: China-Nexus Campaign Targeting India's Tax Infrastructure via DcRAT | Community Portal | Gurucul
Jun 26, 20264mo ago
Seqrite publishes Operation DragonReturn technical findings
Seqrite publicly reported Operation DragonReturn and assessed with medium-to-high confidence that it was linked to a China-aligned threat cluster. The report described infrastructure overlaps, Chinese-language artifacts, Silver Fox TTP similarities, process injection into svchost.exe, AMSI bypass, and fileless execution of a decrypted .NET assembly.
Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment - Malware Analysis - Malware Analysis, News and Indicators
Jun 25, 20264mo ago
Unit 42 reports CL-STA-1062 espionage in Southeast Asia
Unit 42 reported threat activity tracked as CL-STA-1062 targeting government entities and critical infrastructure organizations in Southeast Asia for espionage. The attackers used a hybrid toolkit that included a custom backdoor named TinyRCT and focused on intelligence collection rather than disruption.
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure - Malware Analysis - Malware Analysis, News and Indicators
Jun 19, 20264mo ago
Seqrite reports Thailand healthcare malware campaign
Seqrite Threat Research Unit publicly reported the targeted campaign against Thailand’s healthcare ecosystem and assessed with moderate confidence that it was a coordinated effort using a standardized toolset. The report detailed credential theft, browser data collection, local staging, ZIP compression, and attempted Telegram-based exfiltration.
Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector - Malware News - Malware Analysis, News and Indicators
Jun 17, 20264mo ago
Operation DragonReturn remained active as of June 17
Seqrite reported that Operation DragonReturn was still active as of June 17, 2026, with payloads rotating every 7–10 days. The campaign used infrastructure tied to multiple domains and an IP address for encrypted TLS command-and-control communications.
Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment - Malware Analysis - Malware Analysis, News and Indicators
Jun 3, 20265mo ago
Thailand healthcare campaign activity observed through June 3
Seqrite reported that the Thailand healthcare-targeting malware campaign was observed from April 7, 2026 through June 3, 2026, indicating sustained activity over nearly two months. All identified samples were reportedly uploaded from Thailand, suggesting local staging infrastructure or compromised in-country systems.
Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector - Malware News - Malware Analysis, News and Indicators
May 18, 20265mo ago
Operation DragonReturn first observed targeting India tax ecosystem
Seqrite first observed Operation DragonReturn, a spear-phishing campaign impersonating India’s Income Tax Department to target taxpayers, tax professionals, corporate finance teams, and related entities during the AY2026-27 filing season. The campaign delivered a fake tax utility ZIP that installed a multi-stage malware chain culminating in DcRAT-related payloads.
Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment - Malware Analysis - Malware Analysis, News and Indicators
Apr 7, 20267mo ago
Thailand healthcare phishing campaign observed
Seqrite observed an active malware campaign targeting Thailand’s healthcare sector, including Ministry of Health personnel and affiliated healthcare organizations, using healthcare-themed spear-phishing lures in malicious RAR archives. The infection chain used obfuscated batch scripts, GitHub-hosted payloads, Startup-folder persistence, and a Python-based information stealer that attempted exfiltration via the Telegram Bot API.
Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector - Malware News - Malware Analysis, News and Indicators

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

DcRAT

Observables

53 linked

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain•••••••.ruIPv4 address•••.••.•••.•••URLhttps://••••••••.•••/•••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain•••••••••••.ruIPv4 address•••.••.•••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

+45

Indicator values are masked on this page. View all 53 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.

Get the Full Actor Profile

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Gurucul Threat ResearchNews · Jun 29, 2026

Operation DragonReturn: China-Nexus Campaign Targeting India's Tax Infrastructure via DcRAT | Community Portal | GuruculOpen source ↗

Malware NewsNews · Jun 26, 2026

Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment - Malware Analysis - Malware Analysis, News and IndicatorsOpen source ↗

Malware NewsNews · Jun 25, 2026

CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure - Malware Analysis - Malware Analysis, News and IndicatorsOpen source ↗

Malware NewsNews · Jun 19, 2026

Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

state-sponsored-espionagephishing-campaign-intelligenceremote-access-implantgovernment-diplomatic-threat

Operation DragonReturn Deploys DcRAT Against India’s Tax Infrastructure

Threat Actor Intelligence · 4 sources · Updated 4mo ago · First seen Jun 19, 2026

Know this adversaryTTPs, infrastructure, and targeting history in one profile.

Get the profile

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Apr 7, 2026 – Jun 29, 2026

Jun 29, 20264mo ago
Gurucul publishes DragonReturn IOCs and detection guidance
Gurucul published additional reporting on Operation DragonReturn, describing it as a high-severity China-nexus cyber-espionage campaign targeting India’s tax infrastructure. The content included indicators of compromise such as domains, IP addresses, SHA-256 hashes, and example detection queries.
Operation DragonReturn: China-Nexus Campaign Targeting India's Tax Infrastructure via DcRAT | Community Portal | Gurucul
Jun 26, 20264mo ago
Seqrite publishes Operation DragonReturn technical findings
Seqrite publicly reported Operation DragonReturn and assessed with medium-to-high confidence that it was linked to a China-aligned threat cluster. The report described infrastructure overlaps, Chinese-language artifacts, Silver Fox TTP similarities, process injection into svchost.exe, AMSI bypass, and fileless execution of a decrypted .NET assembly.
Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment - Malware Analysis - Malware Analysis, News and Indicators
Jun 25, 20264mo ago
Unit 42 reports CL-STA-1062 espionage in Southeast Asia
Unit 42 reported threat activity tracked as CL-STA-1062 targeting government entities and critical infrastructure organizations in Southeast Asia for espionage. The attackers used a hybrid toolkit that included a custom backdoor named TinyRCT and focused on intelligence collection rather than disruption.
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure - Malware Analysis - Malware Analysis, News and Indicators
Jun 19, 20264mo ago
Seqrite reports Thailand healthcare malware campaign
Seqrite Threat Research Unit publicly reported the targeted campaign against Thailand’s healthcare ecosystem and assessed with moderate confidence that it was a coordinated effort using a standardized toolset. The report detailed credential theft, browser data collection, local staging, ZIP compression, and attempted Telegram-based exfiltration.
Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector - Malware News - Malware Analysis, News and Indicators
Jun 17, 20264mo ago
Operation DragonReturn remained active as of June 17
Seqrite reported that Operation DragonReturn was still active as of June 17, 2026, with payloads rotating every 7–10 days. The campaign used infrastructure tied to multiple domains and an IP address for encrypted TLS command-and-control communications.
Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment - Malware Analysis - Malware Analysis, News and Indicators
Jun 3, 20265mo ago
Thailand healthcare campaign activity observed through June 3
Seqrite reported that the Thailand healthcare-targeting malware campaign was observed from April 7, 2026 through June 3, 2026, indicating sustained activity over nearly two months. All identified samples were reportedly uploaded from Thailand, suggesting local staging infrastructure or compromised in-country systems.
Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector - Malware News - Malware Analysis, News and Indicators
May 18, 20265mo ago
Operation DragonReturn first observed targeting India tax ecosystem
Seqrite first observed Operation DragonReturn, a spear-phishing campaign impersonating India’s Income Tax Department to target taxpayers, tax professionals, corporate finance teams, and related entities during the AY2026-27 filing season. The campaign delivered a fake tax utility ZIP that installed a multi-stage malware chain culminating in DcRAT-related payloads.
Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment - Malware Analysis - Malware Analysis, News and Indicators
Apr 7, 20267mo ago
Thailand healthcare phishing campaign observed
Seqrite observed an active malware campaign targeting Thailand’s healthcare sector, including Ministry of Health personnel and affiliated healthcare organizations, using healthcare-themed spear-phishing lures in malicious RAR archives. The infection chain used obfuscated batch scripts, GitHub-hosted payloads, Startup-folder persistence, and a Python-based information stealer that attempted exfiltration via the Telegram Bot API.
Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector - Malware News - Malware Analysis, News and Indicators

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

DcRAT

Observables

53 linked

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain•••••••.ruIPv4 address•••.••.•••.•••URLhttps://••••••••.•••/•••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain•••••••••••.ruIPv4 address•••.••.•••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

+45

Indicator values are masked on this page. View all 53 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.

Get the Full Actor Profile

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Gurucul Threat ResearchNews · Jun 29, 2026

Operation DragonReturn: China-Nexus Campaign Targeting India's Tax Infrastructure via DcRAT | Community Portal | GuruculOpen source ↗

Malware NewsNews · Jun 26, 2026

Malware NewsNews · Jun 25, 2026

CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure - Malware Analysis - Malware Analysis, News and IndicatorsOpen source ↗

Malware NewsNews · Jun 19, 2026

Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Operation DragonReturn Deploys DcRAT Against India’s Tax Infrastructure

How this story unfolded

Gurucul publishes DragonReturn IOCs and detection guidance

Seqrite publishes Operation DragonReturn technical findings

Unit 42 reports CL-STA-1062 espionage in Southeast Asia

Seqrite reports Thailand healthcare malware campaign

Operation DragonReturn remained active as of June 17

Thailand healthcare campaign activity observed through June 3

Operation DragonReturn first observed targeting India tax ecosystem

Thailand healthcare phishing campaign observed

Related entities

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Fake Indian Tax Notices Deliver DCRat and ValleyRat in China-Linked Campaign

Fake Indian Tax Notice Campaign Delivers XWorm-Like RAT

Chinese APT-Linked Tax-Themed Phishing Campaign Targeting India

Operation DragonReturn Deploys DcRAT Against India’s Tax Infrastructure

How this story unfolded

Gurucul publishes DragonReturn IOCs and detection guidance

Seqrite publishes Operation DragonReturn technical findings

Unit 42 reports CL-STA-1062 espionage in Southeast Asia

Seqrite reports Thailand healthcare malware campaign

Operation DragonReturn remained active as of June 17

Thailand healthcare campaign activity observed through June 3

Operation DragonReturn first observed targeting India tax ecosystem

Thailand healthcare phishing campaign observed

Related entities

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Fake Indian Tax Notices Deliver DCRat and ValleyRat in China-Linked Campaign

Fake Indian Tax Notice Campaign Delivers XWorm-Like RAT

Chinese APT-Linked Tax-Themed Phishing Campaign Targeting India