Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver a remote access trojan designed to steal sensitive data from compromised hosts. The multi-stage campaign, codenamed Operation DragonReturn by Seqrite Labs, involves sending spear-phishing emails impersonating the Income Tax Department of India.

The article describes Operation DragonReturn, a suspected China‑nexus cyber espionage campaign that uses spear‑phishing emails impersonating India’s Income Tax Department and a fake offline tax filing utility to deploy the DcRAT remote access trojan against Indian taxpayers and financial professionals.[1][3] Seqrite Labs reports a multi‑stage chain with DLL sideloading, steganographic payload hiding in JPG images, fileless .NET execution, AMSI bypass, and long‑term persistence via disguised Windows services, all aimed at credential theft and systematic data exfiltration from tax and financial infrastructure.[3][4] From a RealGround perspective, this illustrates high‑maturity, state‑aligned tradecraft that could be repurposed to target AI‑enabled financial, tax, or decision systems, making continuous red‑teaming and CISO‑level AI threat modeling critical to ensure that spear‑phishing, supply‑chain style payload delivery, and covert RAT access cannot be leveraged to manipulate or exfiltrate sensitive AI workloads. Organizations should integrate these IoCs and TTPs into AI environment monitoring, harden email and endpoint controls around AI‑connected systems, and regularly simulat