Operation DragonReturn — China-Nexus DcRAT Multi-Stage Espionage Campaign Targeting Govt. of India Ministry of Finance / Income Tax Infrastructure
Operation DragonReturn (TL-2026-0956), also tracked as Operation DragonReturn, is a critical-severity malware campaign, first published 2026-06-27. It is attributed to DragonReturn (China) with medium confidence, affects Microsoft Windows (endpoint), maps to 31 MITRE ATT&CK techniques (T1005, T1010, T1027), and is covered by 9 detection rules and 41 indicators of compromise.
Key facts for TL-2026-0956
- Threat ID
- TL-2026-0956
- Also known as
- Operation DragonReturn
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-27
- Last reviewed
- 2026-06-27
- Attribution
- DragonReturn
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government, financial, taxation, professional services, corporate finance
- Target regions
- India, Asia
- Detection rules
- 9
- Indicators of compromise
- 41
Malware and tooling in Operation DragonReturn
Malware and tooling: DCRat, Seqrite detections: Malware.Ulise, Trojan.Ulise, Trojan.Phonzy, Trojan.Ravartar, Trojandownloader.Smallao, Trojan.InjectorCiR
Operation DragonReturn is an active China-aligned cyber-espionage campaign (medium-to-high confidence, infrastructure and TTP overlaps with the Silver Fox cluster) that abuses India's AY2026-27 ITR filing season. Spear-phishing impersonating the Income Tax Department / Ministry of Finance delivers a ZIP masquerading as the official 'Common Offline Utility', which executes a multi-stage DcRAT chain using DLL side-loading, UAC and AMSI bypass, JPEG steganography, fileless .NET execution, and svchost process injection, persisting as a fake 'Windows Mixed Reality Service'.
How Operation DragonReturn works
Operation DragonReturn is a sustained, targeted cyber-espionage campaign observed by Seqrite Labs between 18 May and 17 June 2026 against the Government of India's financial and tax ecosystem, including taxpayers, chartered accountants, tax consultants, corporate finance teams, and government contractors across India. The operators time the campaign to the AY2026-27 Income Tax Return (ITR) filing season and impersonate the Income Tax Department / Ministry of Finance.
Initial access is achieved via spear-phishing emails carrying a PDF attachment that cites real legal provisions (Income Tax Act Sections 271(1)(c) and 276C), a fabricated signatory ('Raj Kumar Sharma, Assistant Commissioner of Income Tax'), and reference number TAX/PEN/2026-142. The PDF embeds a link to govtop[.]one/incometax, which redirects to a ZIP named 'Common_Offline_Utility_ITR-1_to_4_AY2026-27.zip'. The ZIP delivers a downloader, COU_ITR-1_to_4_AY2026-27.exe, that impersonates the official ITR offline utility.
The execution chain is multi-stage. The Stage-1 downloader uses sc.exe (Windows Service Control) via cmd.exe to register a malicious auto-start service 'MixedSvc' with display name 'Windows Mixed Reality Service' and binary path C:\Program Files\Windows Media Player\Mixed Reality.exe. A companion DLL, nvdaHelperRemote.dll (exports injection_initialize() and injection_terminate()), performs a privilege check via CheckTokenMembership() and a UAC bypass via ShellExecuteW() with the 'runas' verb, creates the mutex Global\ShitSetupOn26126k, and spawns worker threads. The loader downloads a steganographic container lllyd.jpg (saved as C:\Windows\background.jpg) and extracts a 504 KB DLL payload written to C:\Program Files\Windows Media Player vdaHelperRemote.dll. It then enumerates processes via CreateToolhelp32Snapshot(), injects into svchost.exe by allocating executable memory, writing the decrypted payload using dynamic API resolution, and creating a remote thread before terminating the original process. Multi-payload deployment uses WTSEnumerateSessionsW() to drop two payloads per active Terminal Services session, writing status to C:\debug.txt (format client=<id>) and using marker files to prevent re-deployment.
Payload A is a DcRAT-family .NET RAT loaded filelessly. Its native loader patches AmsiOpenSession() in memory using VirtualProtect() to disable AMSI scanning, performs anti-sandbox timing checks via GetTickCount64() loops, decrypts an embedded AES-encrypted resource via Windows CNG (BCryptOpenAlgorithmProvider/BCryptDecrypt) with a hardcoded 16-byte key, then initializes the CLR (CLRCreateInstance, .NET 4.0.30319), loads the managed assembly via AppDomain::Load_3() and invokes its entry point via MethodInfo::Invoke_3() entirely in memory. The RAT establishes a TLS channel via System.Net.Security.SslStream to 223.26.63.40:2671 / ikkkkddd[.]com, registers the victim via IdSender.SendInfo(), and exfiltrates an extensive fingerprint (HWID, username, OS version/architecture, executable path, malware version, privilege level, active window title, installed AV products, executable timestamp, campaign group identifier, operator notes, and system idle time). Field names are resolved at runtime via string deobfuscation, serialized as MessagePack and ZIP-compressed before transmission.
Payload B is a surveillance component providing screen capture via an embedded desktop-capture library (dsc_* exports), TurboJPEG compression (tjInitCompress/tjCompress2/tjFree/tjDestroy), and zlib compression (compress2/uncompress). It resolves its primary C2 kkxqbh[.]top in a DNS loop, with automatic connection recovery and periodic state monitoring on a dedicated thread.
Infrastructure is hosted on ChinaNet (AS4134, China Telecom Jiangxi), CTG Server Limited (AS152194), and Turing Group Limited (AS140869), geolocated to Nanchang, Jiangxi Province, China, with a Chinese-language management panel ('豪凌1.6 - Web管理面板'). Attribution is medium-to-high confidence to a China-aligned cluster with overlaps to Silver Fox, based on ChinaNet hosting, Chinese-language artifacts, TTP overlaps, and targeting of government financial infrastructure. The campaign rotated payloads every 7-10 days (five documented variants), with the latest reaching 0/66 VirusTotal detection on 12 June 2026, and remained fully active as of 17 June 2026. No CVE is involved; initial access is purely social-engineering driven.
MITRE ATT&CK techniques used in TL-2026-0956
Collection
T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data
Discovery
T1010 Application Window Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1518 Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1574 Hijack Execution Flow; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution; T1569 System Services
Command and Control
T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1573 Encrypted Channel
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Initial Access
defense-impairment
Affected products and versions in Operation DragonReturn
- Microsoft — Windows (endpoint)
Vulnerable versions: Windows 10; Windows 11; Windows Server - Government of India — Income Tax / Ministry of Finance taxpayer ecosystem (impersonated ITR Offline Utility)
Vulnerable versions: AY2026-27 ITR filing workflow
Remediation for Operation DragonReturn
Immediate actions
- Block all listed C2 IPs (223.26.63.40, 204.194.48.250, 118.107.0.197, 27.50.54.191) and domains (govtop.one, ikkkkddd.com, 1kkkkddd.com, kkxqbh.top, simaqz.com, jiayingjing.com) at perimeter, DNS, and proxy.
- Quarantine endpoints exhibiting the MixedSvc service, mutex Global\ShitSetupOn26126k, or files C:\Windows\background.jpg / C:\debug.txt.
- Hunt for the listed SHA256 sample hashes across EDR and email gateways; purge matching emails referencing TAX/PEN/2026-142 or the AY2026-27 ITR utility.
- Alert finance/tax staff that the official ITR offline utility is ONLY distributed via incometax.gov.in and that ZIP/EXE versions delivered by email are malicious.
Workarounds
- Disable auto-extraction/auto-run of email-delivered archives.
- Enforce mark-of-the-web and block macro/script execution from downloaded ZIP content.
- Network-segment finance/tax workstations and restrict outbound traffic to known-good destinations.
Longer-term hardening
- Deploy EDR with behavioral detection for AMSI patching, reflective .NET loading, and remote-thread injection into svchost.exe.
- Enforce attack-surface-reduction rules blocking executable content from email/ZIP and child process creation by Office/PDF readers.
- Application allowlisting to prevent unsigned binaries executing from C:\Program Files\Windows Media Player and user temp paths.
- Restrict and monitor sc.exe / service-creation events and scheduled-task creation by non-admin contexts.
Timeline of Operation DragonReturn
- Beginning of payload rotation cycle; five DcRAT variants deployed on a 7-10 day rotation through 10 June 2026.
- Operation DragonReturn first observed by Seqrite Labs targeting Govt. of India MoF / Income Tax infrastructure.
- Spear-phishing email impersonating the Income Tax Department (ref TAX/PEN/2026-142, fabricated signatory 'Raj Kumar Sharma, Assistant Commissioner of Income Tax') actively distributed, abusing the AY2026-27 ITR filing season.
- Fifth and latest DcRAT variant in the 7-10 day rotation deployed — the build that subsequently reaches 0/66 VirusTotal detection.
- Malicious ZIP 'Common_Offline_Utility_ITR-1_to_4_AY2026-27.zip' delivering the COU downloader deployed to victims via the govtop[.]one/incometax redirect.
- Latest DcRAT variant achieves 0/66 detection on VirusTotal, evading all engines.
- Campaign confirmed fully active with no slowdown after 31 days (18 May - 17 June 2026) of continuous operation; last day of Seqrite's documented observation window.
- Seqrite publishes the Operation DragonReturn analysis disclosing TTPs, IOCs, and China-nexus / Silver Fox attribution.
Sources cited for Operation DragonReturn
- Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment
- Silver Fox APT Targets Taiwan with Complex Gh0stCringe and HoldingHands RAT Malware
- Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains
- Chasing the Silver Fox: Cat & Mouse in Kernel Shadows
- Threat Spotlight: Silver Fox's Russian Ruse — ValleyRAT via Fake Microsoft Teams
- Silver Fox APT Targets Public Sector via Trojanized Medical Software
- MITRE ATT&CK — Enterprise Techniques
Threats related to Operation DragonReturn
- The TTF Trap: Global Phishing Campaign Delivers Lua-Based Loader for Agent Tesla, Remcos RAT, XWorm
- TA4922 Deploys PackClient RAT via Tax-Themed Phishing Against Organizations in China and India
- Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign Impersonating Payment Confirmations
- SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark Campaign
- MLTBackdoor (Backdoor.Mistic): KongTuke-Linked Windows Backdoor Delivered via ClickFix and mpextms.exe DLL Sideloading
- Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico with Multi-Stage Loader and Email Spreader
Detection coverage for TL-2026-0956
As of 2026-06-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0956 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0956
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.