Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

Seqrite Labs uncovered Operation DragonReturn, a campaign targeting Indian taxpayers with phishing emails impersonating the Income Tax Department. The attack uses a fake tax utility to sideload a DLL, deploying DcRAT for data theft. Infrastructure overlaps with Chinese cybercrime group Silver Fox suggest a China-nexus threat actor.