Threat reportMalwareTL-2026-1443
GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET Bitmap-Steganography Infection Chain
GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET (TL-2026-1443), also tracked as Behind the Refund GST Phishing Campaign, is a high-severity malware campaign, first published 2026-07-17. It has no confirmed attribution, affects Microsoft Windows (cmstp.exe / .NET runtime), maps to 26 MITRE ATT&CK techniques (T1005, T1016, T1021), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 26MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-1443
- Threat ID
- TL-2026-1443
- Also known as
- Behind the Refund GST Phishing Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government administration, finance, taxpayers, small-business, professional-services
- Target regions
- india
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET
Malware and tooling: Remcos
How GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET works
A phishing campaign spoofing India's GST tax authority ('donotreply.@gst.gov.in') lures victims with a fraudulent GST RFD-01 refund notice into opening a malicious RAR attachment, triggering a five-stage .NET loader chain that hides its second stage inside bitmap pixel RGB values, reflectively loads a third-stage DLL, abuses cmstp.exe for privilege escalation, and deploys Remcos RAT entirely in-memory for remote access, keylogging, and credential theft.
Seqrite identified an active phishing campaign (first seen on VirusTotal July 6, 2026) impersonating India's Goods and Services Tax (GST) authority. The lure email, spoofed from 'donotreply.@gst.gov.in', uses the subject 'Refund Application GST RFD-01 filed vide ARN AL27052600952P' and carries a RAR attachment (GST-Refund_July-26_AL27052600952P.rar) containing a disguised .NET executable (GST-Refund_July-26_AL27052600952P.com).
The infection chain runs in five stages. Stage 1 is the initial .NET loader, which calls a function named ServiceChromatic() to reconstruct a 64,000-byte payload from the RGB channel values of a bundled bitmap image, iterating the pixel grid in column-major order, then loads the reconstructed assembly reflectively via Assembly.Load() — a bitmap-steganography technique that avoids storing the next stage as a conventional embedded resource. Stage 2, 'Windows Health Optimizer Plus.dll', is invoked with command-line-style parameters 'sStW' (bitmap processing) and 'inj' (injection), and uses XOR decryption keyed with UTF-16 Big Endian material to unpack the next stage. Stage 3, 'perfgurd.dll' (internally PerfGuard.dll), is loaded entirely in-memory and selects its execution method by reflection using an architecture-dependent method index (29 for x86, 15 for x64). When the process lacks administrative rights, the chain abuses cmstp.exe (Microsoft Connection Manager Profile Installer), a signed living-off-the-land binary, to respawn itself with elevated privileges. The final stage deploys Remcos RAT entirely in-memory — no RAT binary is written to disk.
Persistence is established by dropping a renamed copy of the loader to C:\Users\admin\AppData\Roaming\RVKLmPcYcNO.exe, generating a PowerShell script in a temp directory for hidden re-execution, and writing an HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry value pointing to that script so the chain restarts on every logon.
Once active, Remcos RAT grants the operator remote command execution, file upload/download and filesystem management, keystroke logging, credential harvesting from browsers and password stores, screen capture, remote-desktop-style control, process/service enumeration and manipulation, registry modification, and delivery of additional payloads over an encrypted C2 channel. Observed C2 infrastructure resolves to 185.242.4.122, hosted by M247 Europe SRL, fronted by dynamic-DNS domains hath.network and synology.me, with randomized subdomains such as aofmokighoig.hath.network — a disposable-infrastructure pattern typical of commodity RAT operators and access brokers rather than a state-nexus actor.
Seqrite and other researchers (ShomoySoft, CyberSecurityNews, GBHackers, K7 Labs) have documented closely related sibling campaigns using near-identical bitmap-steganography loader chains under GST/NEFT/RTGS/IMPS-themed lures, delivering not only Remcos but also Agent Tesla, Phantom Stealer, DarkCloud, RedLine Stealer, MassLogger variants, Formbook, XWorm, and Snake Keylogger — consistent with a loader-as-a-service model shared across multiple India-focused financially motivated operators. Attribution for this specific sample is assessed as an India-focused Remcos operator or Initial Access Broker; the tradecraft pattern echoes prior Seqrite-tracked activity such as 'Operation ShadowRecruit' (ControlR/Google-Sheets recruitment lures) and the China-nexus 'Operation DragonReturn' (DcRAT against India's Ministry of Finance), but no infrastructure or tooling overlap with either was established, keeping attribution confidence low.
MITRE ATT&CK techniques used in TL-2026-1443
Collection
T1005 Data from Local System; T1039 Data from Network Shared Drive; T1113 Screen Capture
Discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218.003 CMSTP; T1620 Reflective Code Loading
Credential Access
T1056.001 Keylogging; T1555 Credentials from Password Stores
Execution
T1059.001 PowerShell; T1129 Shared Modules; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer
Impact
Persistence
T1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1548.002 Bypass User Account Control
Initial Access
Affected products and versions in GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET
- Microsoft — Windows (cmstp.exe / .NET runtime)
Vulnerable versions: All supported Windows versions with cmstp.exe and .NET Framework/Core
Remediation for GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET
Immediate actions
- Block C2 IP 185.242.4.122 and hosting range at M247 Europe SRL at the network perimeter
- Block/sinkhole dynamic-DNS domains hath.network, synology.me, and *.hath.network subdomains
- Quarantine and hash-block known samples (GST-Refund_July-26_AL27052600952P.rar/.com, Windows Health Optimizer Plus.dll, PerfGuard.dll, RemcosRAT payload)
- Alert on inbound mail from 'donotreply.@gst.gov.in' or lookalike GST-authority senders
- Hunt for HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries pointing to PowerShell scripts in %TEMP%/%AppData%
- Hunt for cmstp.exe spawning child processes with no associated .inf profile install
Workarounds
- Restrict PowerShell execution policy and log ScriptBlock/Module execution via AMSI+ETW
- Enforce email attachment sandboxing/detonation for RAR/ZIP archives from external senders
Longer-term hardening
- Deploy EDR with in-memory/reflective-loading and process-injection detection (Assembly.Load from non-standard paths)
- Restrict execution of RAR/archive attachments containing executables via email gateway policy
- Implement application allowlisting to block unsigned .NET binaries launched from user-writable paths
- Disable or tightly constrain cmstp.exe via AppLocker/WDAC given its known UAC-bypass abuse pattern
- Deploy network detection for Remcos' default C2 port 2404 and known secondary ports (5000, 5060, 5061, 8268, 8808)
- User awareness training on GST refund / tax-authority phishing lures
Weaknesses (CWE) in GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET
Timeline of GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET
- India's Cyber Swachhta Kendra (CERT-In) publishes a Remcos RAT advisory describing prior in-memory PowerShell-loader delivery via LNK/mshta and listing separate C2 infrastructure, establishing Remcos as an already-tracked threat to Indian users
- K7 Labs first publishes analysis of a sibling steganographic loader sample ('GST Debit Note Apr_26.com'), predating the Seqrite report by nearly a month and indicating the same loader chain had been circulating under GST/tax-themed lures since at least April 2026
- First sample uploaded to VirusTotal, marking initial public visibility of the GST refund phishing campaign
- Threat ingested into TL-Intel-Harness backlog from Seqrite Blog RSS feed and promoted to tracked skeleton TL-2026-1443
- K7 Labs documents a broader multi-stage steganographic loader campaign delivering diverse payloads (Agent Tesla, Phantom Stealer, DarkCloud, RedLine Stealer, MassLogger, Formbook, XWorm, Snake Keylogger) globally, indicating a shared loader-as-a-service ecosystem
- CyberSecurityNews, ShomoySoft, TeamWin, CyberPress, and GBHackers publish syndicated/related coverage of a sibling GST Debit Note-themed Remcos loader campaign sharing the same steganographic loader chain
- Seqrite publishes 'Behind the Refund' analysis detailing the five-stage bitmap-steganography .NET loader chain delivering Remcos RAT
- Phishing email subject and RAR filename ('...GST RFD-01 filed vide ARN AL27052600952P' / 'GST-Refund_July-26_AL27052600952P.rar') reference a forward-dated ARN/refund filing of July 26, 2026, indicating the lure was crafted to align with an anticipated GST filing/refund cycle date
Sources cited for GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET
- Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain
- Malicious GST Debit Note Attachment Deploys Remcos RAT Through Multi-Stage Loader
- Malicious GST Debit Note Attachment Deploys Remcos RAT Through Multi-Stage Loader
- Malicious GST Debit Note Attachment Deploys Remcos RAT Through Multi-Stage
- Hackers Use Steganographic Loader to Deliver Remcos RAT via Phishing Attachments
- Multi-Stage Steganographic Loader Deploys Remcos RAT and Multiple Infostealers Globally
- A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally
- Cyber Swachhta Kendra: Remcos RAT Advisory
- Fake Indian Tax Notice Campaign Delivers XWorm-Like RAT
- Remcos RAT C2 Activity Mapped Along with The Ports Used for Communications
- Deceptive Layoff-Themed HR Email Distributes Remcos RAT Malware
Detection coverage for TL-2026-1443
As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1443 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.