GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET Bitmap-Steganography Infection Chain — Threadlinqs Intelligence
As of 2026-07-17, GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET Bitmap-Steganography Infection Chain is a high-severity malware threat attributed to Unknown (India-focused Remcos operator, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-1443 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Unknown (India-focused Remcos operator · FINANCIAL
A phishing campaign spoofing India's GST tax authority ('donotreply.@gst.gov.in') lures victims with a fraudulent GST RFD-01 refund notice into opening a malicious RAR attachment, triggering a
Seqrite identified an active phishing campaign (first seen on VirusTotal July 6, 2026) impersonating India's Goods and Services Tax (GST) authority. The lure email, spoofed from 'donotreply.@gst.gov.in', uses the subject 'Refund Application GST RFD-01 filed vide ARN AL27052600952P' and carries a RAR attachment (GST-Refund_July-26_AL27052600952P.rar) containing a disguised .NET executable (GST-Refund_July-26_AL27052600952P.com).
The infection chain runs in five stages. Stage 1 is the initial .NET loader, which calls a function named ServiceChromatic() to reconstruct a 64,000-byte payload from the RGB channel values of a bundled bitmap image, iterating the pixel grid in column-major order, then loads the reconstructed assembly reflectively via Assembly.Load() — a bitmap-steganography technique that avoids storing the next stage as a conventional embedded resource. Stage 2, 'Windows Health Optimizer Plus.dll', is invoked with command-line-style parameters 'sStW' (bitmap processing) and 'inj' (injection), and uses XOR decryption keyed with UTF-16 Big Endian material to unpack the next stage. Stage 3, 'perfgurd.dll' (internally PerfGuard.dll), is loaded entirely in-memory and selects its execution method by reflection using an architecture-dependent method index (29 for x86, 15 for x64). When the process lacks administrative rights, the chain abuses cmstp.exe (Microsoft Connection Manager Profile Installer), a signed living-off-the-land binary, to respawn itself with elevated privileges. The final stage deploys Remcos RAT entirely in-memory — no RAT binary is written to disk.
Persistence is established by dropping a renamed copy of the loader to C:\Users\admin\AppData\Roaming\RVKLmPcYcNO.exe, generating a PowerShell script in a temp directory for hidden re-execution, and writing an HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry value pointing to that script so the chain restarts on every logon.
Once active, Remcos RAT grants the operator remote command execution, file upload/download and filesystem management, keystroke logging, credential harvesting from browsers and password stores, screen capture, remote-desktop-style control, process/service enumeration and manipulation, registry modification, and delivery of additional payloads over an encrypted C2 channel. Observed C2 infrastructure resolves to 185.242.4.122, hosted by M247 Europe SRL, fronted by dynamic-DNS domains hath.network and synology.me, with randomized subdomains such as aofmokighoig.hath.network — a disposable-infrastructure pattern typical of commodity RAT operators and access brokers rather than a state-nexus actor.
Seqrite and other researchers (ShomoySoft, CyberSecurityNews, GBHackers, K7 Labs) have documented closely related sibling campaigns using near-identical bitmap-steganography loader chains under GST/NEFT/RTGS/IMPS-themed lures, delivering not only Remcos but also Agent Tesla, Phantom Stealer, DarkCloud, RedLine Stealer, MassLogger variants, Formbook, XWorm, and Snake Keylogger — consistent with a loader-as-a-service model shared across multiple India-focused financially motivated operators. Attribution for this specific sample is assessed as an India-focused Remcos operator or Initial Access Broker; the tradecraft pattern echoes prior Seqrite-tracked activity such as 'Operation ShadowRecruit' (ControlR/Google-Sheets recruitment lures) and the China-nexus 'Operation DragonReturn' (DcRAT against India's Ministry of Finance), but no infrastructure or tooling overlap with either was established, keeping attribution confidence low.
Weaknesses (CWE)
CWE-506, CWE-694
Target sectors: government administration, finance, taxpayers, small-business, professional-services
Target regions: india
Detections & IOCs
As of 2026-07-22, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566.001, T1204.002, T1059.001, T1129, T1547.001, T1036, T1548.002, T1027, T1027.013, T1140