# Operation DragonReturn — China-Nexus DcRAT Multi-Stage Espionage Campaign Targeting Govt. of India Ministry of Finance / Income Tax Infrastructure

> Operation DragonReturn is an active China-aligned cyber-espionage campaign (medium-to-high confidence, infrastructure and TTP overlaps with the Silver Fox cluster) that abuses India's AY2026-27 ITR filing season. Spear-phishing impersonating the Income Tax Department / Ministry of Finance delivers a ZIP masquerading as the official 'Common Offline Utility', which executes a multi-stage DcRAT chain using DLL side-loading, UAC and AMSI bypass, JPEG steganography, fileless .NET execution, and svchost process injection, persisting as a fake 'Windows Mixed Reality Service'.

- **Published:** 2026-06-27T00:00:00Z
- **Last reviewed:** 2026-06-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0956
- **ID:** TL-2026-0956
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** DragonReturn (China)
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Operation DragonReturn is a sustained, targeted cyber-espionage campaign observed by Seqrite Labs between 18 May and 17 June 2026 against the Government of India's financial and tax ecosystem, including taxpayers, chartered accountants, tax consultants, corporate finance teams, and government contractors across India. The operators time the campaign to the AY2026-27 Income Tax Return (ITR) filing season and impersonate the Income Tax Department / Ministry of Finance.

Initial access is achieved via spear-phishing emails carrying a PDF attachment that cites real legal provisions (Income Tax Act Sections 271(1)(c) and 276C), a fabricated signatory ('Raj Kumar Sharma, Assistant Commissioner of Income Tax'), and reference number TAX/PEN/2026-142. The PDF embeds a link to govtop[.]one/incometax, which redirects to a ZIP named 'Common_Offline_Utility_ITR-1_to_4_AY2026-27.zip'. The ZIP delivers a downloader, COU_ITR-1_to_4_AY2026-27.exe, that impersonates the official ITR offline utility.

The execution chain is multi-stage. The Stage-1 downloader uses sc.exe (Windows Service Control) via cmd.exe to register a malicious auto-start service 'MixedSvc' with display name 'Windows Mixed Reality Service' and binary path C:\Program Files\Windows Media Player\Mixed Reality.exe. A companion DLL, nvdaHelperRemote.dll (exports injection_initialize() and injection_terminate()), performs a privilege check via CheckTokenMembership() and a UAC bypass via ShellExecuteW() with the 'runas' verb, creates the mutex Global\ShitSetupOn26126k, and spawns worker threads. The loader downloads a steganographic container lllyd.jpg (saved as C:\Windows\background.jpg) and extracts a 504 KB DLL payload written to C:\Program Files\Windows Media Player\nvdaHelperRemote.dll. It then enumerates processes via CreateToolhelp32Snapshot(), injects into svchost.exe by allocating executable memory, writing the decrypted payload using dynamic API resolution, and creating a remote thread before terminating the original process. Multi-payload deployment uses WTSEnumerateSessionsW() to drop two payloads per active Terminal Services session, writing status to C:\debug.txt (format client=<id>) and using marker files to prevent re-deployment.

Payload A is a DcRAT-family .NET RAT loaded filelessly. Its native loader patches AmsiOpenSession() in memory using VirtualProtect() to disable AMSI scanning, performs anti-sandbox timing checks via GetTickCount64() loops, decrypts an embedded AES-encrypted resource via Windows CNG (BCryptOpenAlgorithmProvider/BCryptDecrypt) with a hardcoded 16-byte key, then initializes the CLR (CLRCreateInstance, .NET 4.0.30319), loads the managed assembly via AppDomain::Load_3() and invokes its entry point via MethodInfo::Invoke_3() entirely in memory. The RAT establishes a TLS channel via System.Net.Security.SslStream to 223.26.63.40:2671 / ikkkkddd[.]com, registers the victim via IdSender.SendInfo(), and exfiltrates an extensive fingerprint (HWID, username, OS version/architecture, executable path, malware version, privilege level, active window title, installed AV products, executable timestamp, campaign group identifier, operator notes, and system idle time). Field names are resolved at runtime via string deobfuscation, serialized as MessagePack and ZIP-compressed before transmission.

Payload B is a surveillance component providing screen capture via an embedded desktop-capture library (dsc_* exports), TurboJPEG compression (tjInitCompress/tjCompress2/tjFree/tjDestroy), and zlib compression (compress2/uncompress). It resolves its primary C2 kkxqbh[.]top in a DNS loop, with automatic connection recovery and periodic state monitoring on a dedicated thread.

Infrastructure is hosted on ChinaNet (AS4134, China Telecom Jiangxi), CTG Server Limited (AS152194), and Turing Group Limited (AS140869), geolocated to Nanchang, Jiangxi Province, China, with a Chinese-language management panel ('豪凌1.6 - Web管理面板'). Attribution is medium-to-high confidence to a China-aligned cluster with overlaps to Silver Fox, based on ChinaNet hosting, Chinese-language artifacts, TTP overlaps, and targeting of government financial infrastructure. The campaign rotated payloads every 7-10 days (five documented variants), with the latest reaching 0/66 VirusTotal detection on 12 June 2026, and remained fully active as of 17 June 2026. No CVE is involved; initial access is purely social-engineering driven.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1569 System Services
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1574 Hijack Execution Flow
- T1564 Hide Artifacts
- T1082 System Information Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1033 System Owner/User Discovery
- T1010 Application Window Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1573 Encrypted Channel
- T1071 Application Layer Protocol
- T1095 Non-Application Layer Protocol
- T1568 Dynamic Resolution
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment](https://www.seqrite.com/blog/operation-dragonreturn-china-nexus-cyber-espionage-campaign-targeting-govt-of-india-mof-tax-infrastructure-via-multi-stage-dcrat-deployment/)
- [Silver Fox APT Targets Taiwan with Complex Gh0stCringe and HoldingHands RAT Malware](https://thehackernews.com/2025/06/silver-fox-apt-targets-taiwan-with.html)
- [Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains](https://thehackernews.com/2026/03/silver-fox-expands-asia-cyber-campaign.html)
- [Chasing the Silver Fox: Cat & Mouse in Kernel Shadows](https://research.checkpoint.com/2025/silver-fox-apt-vulnerable-drivers/)
- [Threat Spotlight: Silver Fox's Russian Ruse — ValleyRAT via Fake Microsoft Teams](https://reliaquest.com/blog/threat-spotlight-silver-foxs-russian-ruse-fake-microsoft-teams-attack/)
- [Silver Fox APT Targets Public Sector via Trojanized Medical Software](https://www.picussecurity.com/resource/blog/silver-fox-apt-targets-public-sector-via-trojanized-medical-software)
- [MITRE ATT&CK — Enterprise Techniques](https://attack.mitre.org/techniques/enterprise/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0956