PAPERMILL Emerges as a Silver Fox-Like Threat Cluster

Summary

A newly identified threat cluster tracked as PAPERMILL is targeting Indian tax-related entities through sophisticated malware delivery techniques. The attackers use ISO disk images to bypass Mark-of-the-Web protections and abuse DLL sideloading with a legitimate Notepad++ executable to load a malicious libcurl.dll. The final payload is VenomRAT, delivered through a Donut loader to improve evasion.

Investigation

The investigation uncovered a multi-stage execution chain involving an ISO container, a signed Notepad++ binary, and a poisoned libcurl.dll. Analysis showed that the Donut loader executes the .NET-based VenomRAT payload directly in memory. Forensic examination of VenomRAT configuration data and builder certificates linked the activity to Chinese-nexus infrastructure and the qwqdanchun builder.

Mitigation

Defenders should enforce strict controls on mounting disk image files such as .iso and .img from untrusted sources. Monitoring for DLL sideloading behavior, particularly signed binaries loading unexpected DLLs from local directories, is critical. Organizations should also watch for unauthorized registry persistence in AppData and suspicious process activity associated with VenomRAT.

Response

If PAPERMILL activity is detected, affected hosts should be isolated immediately to stop C2 communication and lateral movement. Responders should perform memory forensics to identify injected .NET payloads and search for processes masquerading as RuntimeBroker.exe. Compromised credentials should be revoked, and RunOnce registry keys audited for unauthorized persistence entries.

Simulation Execution

• Attack Narrative & Commands: The adversary aims to execute a DLL side-loading attack to establish persistence and execute a payload. To bypass security controls, they use an ISO image named Tax_Notice_45594.img which, when mounted, effectively strips the “Mark of the Web” from the contents. Once the user interacts with the volume, the attacker drops a malicious DLL named Stage2.dll into a directory alongside a legitimate application. The detection rule is expected to trigger when it sees the file system events associated with these specific, highly targeted filenames.

• Regression Test Script:

  # Simulation script to trigger the specific detection rule via filename matching.
  # Note: This script simulates the file creation events.
  
  $targetDir = "C:UsersPublicDownloads_Sim"
  if (!(Test-Path $targetDir)) { New-Item -Path $targetDir -ItemType Directory }
  
  Write-Host "[+] Simulating attack file creation..." -ForegroundColor Cyan
  
  # Simulate the creation of the suspicious ISO/IMG file (Selection 1)
  $imgFile = Join-Path $targetDir "Tax_Notice_45594.img"
  New-Item -Path $imgFile -ItemType "File" -Value "Simulated ISO Content" -Force
  
  # Simulate the creation of the suspicious DLL file (Selection 2)
  $dllFile = Join-Path $targetDir "Stage2.dll"
  New-Item -Path $dllFile -ItemType "File" -Value "Simulated Malicious DLL Content" -Force
  
  Write-Host "[!] Simulation complete. Check SIEM for detection: Suspicious ISO File and DLL Side-Loading Detection" -ForegroundColor Yellow

• Cleanup Commands:

  # Cleanup the simulated attack artifacts.
  $targetDir = "C:UsersPublicDownloads_Sim"
  if (Test-Path $targetDir) {
      Remove-Item -Path $targetDir -Recurse -Force
      Write-Host "[+] Cleanup complete." -ForegroundColor Green
  }