GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET Bitmap-Steganography Infection Chain

GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET (TL-2026-1443), also tracked as Behind the Refund GST Phishing Campaign, is a high-severity malware campaign, first published 2026-07-17. It is attributed to IAB with low confidence, affects Microsoft Windows (cmstp.exe / .NET runtime), maps to 26 MITRE ATT&CK techniques (T1005, T1016, T1021), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-1443

Threat ID
TL-2026-1443
Also known as
Behind the Refund GST Phishing Campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-17
Last reviewed
2026-07-17
Attribution
IAB
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
government administration, finance, taxpayers, small-business, professional-services
Target regions
india
Detection rules
9
Indicators of compromise
22

Malware and tooling in GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET

Malware and tooling: Remcos

A phishing campaign spoofing India's GST tax authority ('donotreply.@gst.gov.in') lures victims with a fraudulent GST RFD-01 refund notice into opening a malicious RAR attachment, triggering a five-stage .NET loader chain that hides its second stage inside bitmap pixel RGB values, reflectively loads a third-stage DLL, abuses cmstp.exe for privilege escalation, and deploys Remcos RAT entirely in-memory for remote access, keylogging, and credential theft.

How GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET works

Seqrite identified an active phishing campaign (first seen on VirusTotal July 6, 2026) impersonating India's Goods and Services Tax (GST) authority. The lure email, spoofed from 'donotreply.@gst.gov.in', uses the subject 'Refund Application GST RFD-01 filed vide ARN AL27052600952P' and carries a RAR attachment (GST-Refund_July-26_AL27052600952P.rar) containing a disguised .NET executable (GST-Refund_July-26_AL27052600952P.com).

The infection chain runs in five stages. Stage 1 is the initial .NET loader, which calls a function named ServiceChromatic() to reconstruct a 64,000-byte payload from the RGB channel values of a bundled bitmap image, iterating the pixel grid in column-major order, then loads the reconstructed assembly reflectively via Assembly.Load() — a bitmap-steganography technique that avoids storing the next stage as a conventional embedded resource. Stage 2, 'Windows Health Optimizer Plus.dll', is invoked with command-line-style parameters 'sStW' (bitmap processing) and 'inj' (injection), and uses XOR decryption keyed with UTF-16 Big Endian material to unpack the next stage. Stage 3, 'perfgurd.dll' (internally PerfGuard.dll), is loaded entirely in-memory and selects its execution method by reflection using an architecture-dependent method index (29 for x86, 15 for x64). When the process lacks administrative rights, the chain abuses cmstp.exe (Microsoft Connection Manager Profile Installer), a signed living-off-the-land binary, to respawn itself with elevated privileges. The final stage deploys Remcos RAT entirely in-memory — no RAT binary is written to disk.

Persistence is established by dropping a renamed copy of the loader to C:\Users\admin\AppData\Roaming\RVKLmPcYcNO.exe, generating a PowerShell script in a temp directory for hidden re-execution, and writing an HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry value pointing to that script so the chain restarts on every logon.

Once active, Remcos RAT grants the operator remote command execution, file upload/download and filesystem management, keystroke logging, credential harvesting from browsers and password stores, screen capture, remote-desktop-style control, process/service enumeration and manipulation, registry modification, and delivery of additional payloads over an encrypted C2 channel. Observed C2 infrastructure resolves to 185.242.4.122, hosted by M247 Europe SRL, fronted by dynamic-DNS domains hath.network and synology.me, with randomized subdomains such as aofmokighoig.hath.network — a disposable-infrastructure pattern typical of commodity RAT operators and access brokers rather than a state-nexus actor.

Seqrite and other researchers (ShomoySoft, CyberSecurityNews, GBHackers, K7 Labs) have documented closely related sibling campaigns using near-identical bitmap-steganography loader chains under GST/NEFT/RTGS/IMPS-themed lures, delivering not only Remcos but also Agent Tesla, Phantom Stealer, DarkCloud, RedLine Stealer, MassLogger variants, Formbook, XWorm, and Snake Keylogger — consistent with a loader-as-a-service model shared across multiple India-focused financially motivated operators. Attribution for this specific sample is assessed as an India-focused Remcos operator or Initial Access Broker; the tradecraft pattern echoes prior Seqrite-tracked activity such as 'Operation ShadowRecruit' (ControlR/Google-Sheets recruitment lures) and the China-nexus 'Operation DragonReturn' (DcRAT against India's Ministry of Finance), but no infrastructure or tooling overlap with either was established, keeping attribution confidence low.

MITRE ATT&CK techniques used in TL-2026-1443

Collection

T1005 Data from Local System; T1039 Data from Network Shared Drive; T1113 Screen Capture

Discovery

T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218.003 CMSTP; T1620 Reflective Code Loading

Credential Access

T1056.001 Keylogging; T1555 Credentials from Password Stores

Execution

T1059.001 PowerShell; T1129 Shared Modules; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer

Impact

T1489 Service Stop

Persistence

T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1548.002 Bypass User Account Control

Initial Access

T1566.001 Spearphishing Attachment

Affected products and versions in GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET

  • Microsoft — Windows (cmstp.exe / .NET runtime)
    Vulnerable versions: All supported Windows versions with cmstp.exe and .NET Framework/Core

Remediation for GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET

Immediate actions

  • Block C2 IP 185.242.4.122 and hosting range at M247 Europe SRL at the network perimeter
  • Block/sinkhole dynamic-DNS domains hath.network, synology.me, and *.hath.network subdomains
  • Quarantine and hash-block known samples (GST-Refund_July-26_AL27052600952P.rar/.com, Windows Health Optimizer Plus.dll, PerfGuard.dll, RemcosRAT payload)
  • Alert on inbound mail from 'donotreply.@gst.gov.in' or lookalike GST-authority senders
  • Hunt for HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries pointing to PowerShell scripts in %TEMP%/%AppData%
  • Hunt for cmstp.exe spawning child processes with no associated .inf profile install

Workarounds

  • Restrict PowerShell execution policy and log ScriptBlock/Module execution via AMSI+ETW
  • Enforce email attachment sandboxing/detonation for RAR/ZIP archives from external senders

Longer-term hardening

  • Deploy EDR with in-memory/reflective-loading and process-injection detection (Assembly.Load from non-standard paths)
  • Restrict execution of RAR/archive attachments containing executables via email gateway policy
  • Implement application allowlisting to block unsigned .NET binaries launched from user-writable paths
  • Disable or tightly constrain cmstp.exe via AppLocker/WDAC given its known UAC-bypass abuse pattern
  • Deploy network detection for Remcos' default C2 port 2404 and known secondary ports (5000, 5060, 5061, 8268, 8808)
  • User awareness training on GST refund / tax-authority phishing lures

Weaknesses (CWE) in GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET

CWE-506, CWE-694

Timeline of GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET

  • India's Cyber Swachhta Kendra (CERT-In) publishes a Remcos RAT advisory describing prior in-memory PowerShell-loader delivery via LNK/mshta and listing separate C2 infrastructure, establishing Remcos as an already-tracked threat to Indian users
  • K7 Labs first publishes analysis of a sibling steganographic loader sample ('GST Debit Note Apr_26.com'), predating the Seqrite report by nearly a month and indicating the same loader chain had been circulating under GST/tax-themed lures since at least April 2026
  • First sample uploaded to VirusTotal, marking initial public visibility of the GST refund phishing campaign
  • Threat ingested into TL-Intel-Harness backlog from Seqrite Blog RSS feed and promoted to tracked skeleton TL-2026-1443
  • K7 Labs documents a broader multi-stage steganographic loader campaign delivering diverse payloads (Agent Tesla, Phantom Stealer, DarkCloud, RedLine Stealer, MassLogger, Formbook, XWorm, Snake Keylogger) globally, indicating a shared loader-as-a-service ecosystem
  • CyberSecurityNews, ShomoySoft, TeamWin, CyberPress, and GBHackers publish syndicated/related coverage of a sibling GST Debit Note-themed Remcos loader campaign sharing the same steganographic loader chain
  • Seqrite publishes 'Behind the Refund' analysis detailing the five-stage bitmap-steganography .NET loader chain delivering Remcos RAT
  • Phishing email subject and RAR filename ('...GST RFD-01 filed vide ARN AL27052600952P' / 'GST-Refund_July-26_AL27052600952P.rar') reference a forward-dated ARN/refund filing of July 26, 2026, indicating the lure was crafted to align with an anticipated GST filing/refund cycle date

Sources cited for GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET

Threats related to GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET

Detection coverage for TL-2026-1443

As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1443 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats