Seqrite Details DragonReturn Campaign Targeting Indian Tax Filers With Multi-Stage DcRAT
Summary
Seqrite says Operation DragonReturn used fake Indian tax-filing lures to deliver a multi-stage DcRAT chain with image-hidden payloads, AMSI bypass, service persistence and encrypted C2. It assesses a China-aligned link based on infrastructure and TTP overlaps.
Key points
- Seqrite observed the campaign from May 18 through June 17, 2026, targeting Indian taxpayers, tax professionals, chartered accountants, and corporate finance teams through Income Tax Department impersonation.
- A lure mimicking an AY2026-27 tax utility led to a malicious ZIP; the campaign used a URL at govtop[.]one/incometax and concealed a secondary payload in a downloaded JPG.
- The malware installs a Windows service named MixedSvc, disguised as Windows Mixed Reality Service, for persistence.
- The analyzed payload uses anti-analysis checks, patches AmsiOpenSession to bypass AMSI, decrypts a .NET assembly for in-memory execution, and injects code into svchost.exe.
- The malware establishes encrypted C2 communications with 223.26.63.40:2671; another payload repeatedly resolves kkxqbh[.]top. The analysis describes collection of host details and a screen-capture capability.
- Seqrite reports that a June payload variant had a 0/66 VirusTotal detection rate; this is the report’s finding, not independent verification of detection effectiveness.
- Seqrite assesses a likely China-aligned link, with medium-to-high confidence, based on infrastructure and TTP overlaps, including similarities to activity associated with Silver Fox; the article does not present this attribution as definitive.
Article Details
- Attack Vectors
- A phishing email impersonating the Income Tax Department carried a tax-notification attachment with an embedded link to govtop[.]one/incometax.
- The lure page prompted recipients to download a ZIP named to resemble the legitimate AY2026-27 offline ITR utility.
- The downloaded executable used a companion DLL to deploy staged payloads, including a payload concealed in a JPG downloaded from 204.194.48.250.
- The malware used cmd.exe and sc.exe to create an automatically starting Windows service named MixedSvc, disguised as Windows Mixed Reality Service.
- A staged payload injected code into svchost.exe, while another decrypted and executed a .NET assembly in memory after patching AMSI.
- The malware communicated with C2 over TLS, transmitting host-registration information; another payload was reported to have desktop-capture capability.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 1kkkkddd[.]com | Domain identified by Seqrite as part of the infrastructure cluster associated with the C2 infrastructure. |
| DOMAIN | ikkkkddd[.]com | Domain identified by Seqrite as part of the associated campaign infrastructure cluster. |
| DOMAIN | jiayingjing[.]com | Domain identified by Seqrite as part of the infrastructure cluster associated with the C2 infrastructure. |
| DOMAIN | kkxqbh[.]top | Hardcoded C2 domain repeatedly resolved by a malware payload. |
| DOMAIN | simaqz[.]com | Domain identified by Seqrite as part of the infrastructure cluster associated with the C2 infrastructure. |
| IPV4 | 117[.]44[.]201[.]119 | Resolved infrastructure associated with the C2 domain kkxqbh[.]top. |
| IPV4 | 118[.]107[.]0[.]197 | Infrastructure identified by Seqrite as related to the campaign during infrastructure pivoting. |
| IPV4 | 204[.]194[.]48[.]250 | Malware used this address to download the JPG containing a secondary payload. |
| IPV4 | 223[.]26[.]63[.]40 | Reported active C2 address; the article identifies port 2671. |
| IPV4 | 27[.]50[.]54[.]191 | Infrastructure identified by Seqrite as related to the campaign during infrastructure pivoting. |
| SHA256 | 1787d1119cd3b40e0e5f19d62821958b7d5c2bbe0518bf1e3fb2e44fdeb4fa58 | SHA-256 of a campaign sample or related payload listed by Seqrite. |
| SHA256 | 2f2f8f92af86fb962c30c4c1c9d673f9d94886373d0fcf78f8d105c051ffc643 | SHA-256 of a campaign sample or related payload listed by Seqrite. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe malware XOR-obfuscated strings and concealed a secondary payload in a JPG file.T1036 · MasqueradingThe service and executable were named and described to resemble legitimate Windows components.T1041 · Exfiltration Over C2 ChannelThe malware sent compressed host-registration data through its established TLS-encrypted C2 channel.T1055 · Process InjectionA payload allocated memory in svchost.exe, wrote decrypted code into it, and started a remote thread.T1059.003 · Windows Command ShellThe malware spawned cmd.exe processes that used sc.exe to create and start its service.T1082 · System Information DiscoveryThe malware collected host details including hardware identifier, username, OS version, and architecture.T1140 · Deobfuscate/Decode Files or InformationThe malware decrypted embedded payload data and strings before execution.T1204.002 · Malicious FileThe lure encouraged recipients to download and execute a disguised ZIP/EXE payload.T1497 · Virtualization/Sandbox EvasionThe malware used timing checks and, when it believed it was in a VM or sandbox, could sleep indefinitely.T1543.003 · Windows ServiceThe malware created the automatically starting MixedSvc Windows service for persistence.T1562.001 · Disable or Modify ToolsThe payload patched AmsiOpenSession() in memory to disable AMSI scanning.T1566.001 · Spearphishing AttachmentA phishing email impersonating the Income Tax Department carried a malicious attachment.T1566.002 · Spearphishing LinkThe attachment contained a link to the campaign’s govtop[.]one/incometax lure page.T1573 · Encrypted ChannelThe malware established an SSL/TLS stream for encrypted C2 communications.T1620 · Reflective Code LoadingThe malware loaded a decrypted .NET assembly into the CLR directly from memory and invoked its entry point.
Threat Actors
Malware
Products
.NET FrameworkIt obtains the runtime interface for .NET Framework v4.0.30319, verifies that the runtime is loadable, starts the CLR, and acquires the default application domain.Microsoft WindowsThe operation uses a fake ITR utility, steganographic payload concealment, AMSI bypass, Windows service persistence, and encrypted C2 infrastructure including govtop[.]one, kkxqbh[.]top, and 223.26.63.40:2671.Windows DefenderBy overwriting instructions within AMSI, the malware effectively disables antimalware scanning of subsequent .NET code, allowing malicious assemblies to execute without being inspected by Windows Defender.
Countries
ChinaSeqrite reported Operation DragonReturn, a China-aligned campaign that impersonates India’s Income Tax Department to target taxpayers, tax professionals, and corporate finance teams with a multi-stage malware chain.IndiaSeqrite reported Operation DragonReturn, a China-aligned campaign that impersonates India’s Income Tax Department to target taxpayers, tax professionals, and corporate finance teams with a multi-stage malware chain.