Fake Indian Tax Notices Deliver DCRat and ValleyRat in China-Linked Campaign

Researchers reported a suspected China-linked phishing campaign targeting Indian taxpayers, tax professionals, and corporate finance teams by impersonating the Income Tax Department of India. The operation, tracked as Operation DragonReturn, used tax-themed emails to lure victims into opening malicious archives and virtual disk files that triggered multi-stage infections through DLL side-loading and hijacking. Observed activity began in mid-May, and investigators said the infrastructure and tradecraft show overlaps with the China-associated group Silver Fox.

The malware chains ultimately deployed remote access trojans including DCRat and ValleyRat, along with secondary payloads for screenshots and data exfiltration. Researchers said the intrusions relied on anti-analysis checks, UAC elevation, image-based payload concealment, encrypted in-memory execution, AMSI bypass, process injection, and persistence via Windows services and the registry. The implants were also capable of downloading additional encrypted modules from command-and-control servers, giving attackers covert, persistent access to victim systems.