Tax season as an attack surface: how a suspected Chinese hacking cluster is running parallel RAT campaigns across India, Japan, and China- 283
July 7, 2026
A suspected China-nexus threat cluster has spent the current Indian tax filing season running a precisely-timed espionage-grade campaign against ordinary taxpayers, tax professionals, and corporate finance teams — and researchers investigating it have found it sitting inside a much larger web of related operations spanning Japan, Chinese-speaking regions, and a previously identified custom malware family, all of which appear to trace back to the same lineage of remote-access tools.
The India-focused operation, tracked by Seqrite Labs as Operation DragonReturn, was first observed on May 18, 2026. It opens with spear-phishing emails impersonating India's Income Tax Department, using fake tax-violation and penalty notices to manufacture urgency and push recipients toward a malicious link embedded in a PDF attachment. Researchers were struck by the operation's polish: the precision of the lure documents, the use of real legal citations, bilingual content, and continuously rotating payloads all point to a deliberate, well-resourced operation built specifically around India's taxpayer ecosystem rather than an opportunistic, one-off scam.
Clicking through leads to a bogus landing page that serves up a ZIP archive disguised as the tax department's own official offline filing utility. In reality, that archive sideloads a malicious file that injects a further payload directly into memory, first checking whether it has administrative rights and, if not, prompting the user themselves to approve elevated permissions through Windows' own security prompt. Once elevated and satisfied it isn't running inside a security researcher's sandbox, the malware quietly fetches what looks like an ordinary image file from a hardcoded server and saves it as a desktop wallpaper file — except that image is a container hiding a second, 504-kilobyte malicious program, which the malware extracts and installs disguised as a Windows Media Player component. It then copies itself under the name "Mixed Reality.exe" and installs itself as a Windows service configured to start automatically every time the computer boots, giving it durable, long-term access.
That Mixed Reality.exe component goes on to deploy two separate payloads. The first disables a core piece of Windows' built-in malware-scanning technology before loading DCRat, a remote-access trojan capable of stealing data from the infected machine. The second is built specifically to take screenshots and quietly send them, along with other stolen data, to a separate remote server. Infrastructure analysis ties the operation to Chinese-registered internet addresses and a Chinese-language web management panel found on the DCRat control server — and researchers identified overlapping infrastructure and tactics with Silver Fox, an already-known Chinese cybercrime group previously linked to tax-themed phishing campaigns delivering a different but related tool called ValleyRAT. Based on that overlap, Seqrite assesses the campaign as the work of a China-aligned actor pursuing covert access for intelligence collection, credential theft, and systematic data exfiltration — not simple financial fraud.
The India campaign turns out not to be an isolated case. Separately, researchers at LevelBlue identified two related campaigns distributing that same ValleyRAT tool against Chinese- and Japanese-speaking users: one using fake installers for the LINE messaging app, the other using phishing emails with salary-adjustment lures. Both ultimately rely on a DLL side-loading technique — tricking a legitimate program into loading a malicious file instead of the real one — to quietly install ValleyRAT. A parallel version of this fake-installer approach, examined separately by Cybereason, uses a specific code-injection method known as PoolParty Variant 7 to insert malicious code into a core Windows process, while also actively working to avoid security analysis.
That same injection technique has a documented history: it was previously seen paired with a custom malware loader called SADBRIDGE, which deploys a version of a remote-access tool named GOSAR — a rewrite, in the Go programming language, of the well-known Quasar RAT. That earlier operation targeted Chinese-speaking regions using fake installers for Telegram and the Opera browser, and was attributed by Elastic Security Labs to a group tracked as REF3864. A Cybereason researcher noted that while there's no conclusive proof, the shared tooling and technique overlap suggests these separate-looking campaigns may in fact be the work of the same underlying actor.
