Operation DragonReturn: China-Nexus Espionage Targeting India’s Tax Infrastructure

Summary

A sophisticated China-aligned cyber espionage campaign is targeting India’s tax ecosystem by impersonating the Ministry of Finance. The operation uses spearphishing emails with malicious attachments to deliver a multi-stage DcRAT infection chain. The malware relies on steganography, AMSI bypass, and fileless .NET execution to persist on compromised systems and exfiltrate sensitive information.

Investigation

Seqrite Lab uncovered the campaign through analysis of a multi-stage infection chain built around a fake government utility. The investigation showed use of a lightweight launcher that calls a DLL, which then injects code into svchost.exe. Analysts also identified steganographic payload hiding inside a JPG image and observed encrypted command-and-control traffic over TLS.

Mitigation

Organizations should deploy strong email filtering to block suspicious attachments and links sent from impersonated government domains. Security teams should monitor for unauthorized Windows service creation, especially services disguised as legitimate components such as Windows Mixed Reality. Enforcing strict UAC policies and watching for suspicious in-memory .NET execution can also help reduce the impact of compromise.

Response

If this activity is detected, affected endpoints should be isolated immediately to prevent additional command-and-control communication and data theft. Investigators should perform memory forensics to identify injected code inside svchost.exe and check for unauthorized services such as MixedSvc. Network logs should also be reviewed for connections to the identified domains and IP addresses, while incident response should focus on credential rotation and verification of system integrity.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has successfully deployed a second-stage dropper. To establish persistence and receive further instructions, the malware attempts to reach out to its hardcoded C2 infrastructure. The attacker’s goal is to bypass standard web proxies by using a non-standard port (2671). The simulation will use PowerShell to mimic this behavior by attempting a TCP connection to the specific domain kkxqbh.top on port 2671, thereby generating the exact domain and port telemetry required by the detection rule.

• Regression Test Script:

  # Simulation of DragonReturn C2 communication
  $C2Domain = "kkxqbh.top"
  $C2Port = 2671
  
  Write-Host "[+] Attempting to simulate C2 connection to $C2Domain on port $C2Port..."
  
  try {
      # Using a TCP Client to initiate a connection to the specific IoCs
      $tcpClient = New-Object System.Net.Sockets.TcpClient
      $connection = $tcpClient.BeginConnect($C2Domain, $C2Port, $null, $null)
  
      # Wait for a short period to allow telemetry to be generated
      $success = $connection.AsyncWaitHandle.WaitOne(5000, $false)
  
      if ($success) {
          Write-Host "[!] Connection established (Simulated C2 Success)."
      } else {
          Write-Host "[?] Connection failed (expected if domain is inactive), but telemetry should have been generated."
      }
      $tcpClient.Close()
  } catch {
      Write-Host "[!] Error during simulation: $_"
  }

• Cleanup Commands:

  # No persistent changes made; no cleanup required for this network-only simulation.
  Write-Host "[+] Simulation complete. No system changes were made."