# GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET Bitmap-Steganography Infection Chain

> A phishing campaign spoofing India's GST tax authority ('donotreply.@gst.gov.in') lures victims with a fraudulent GST RFD-01 refund notice into opening a malicious RAR attachment, triggering a five-stage .NET loader chain that hides its second stage inside bitmap pixel RGB values, reflectively loads a third-stage DLL, abuses cmstp.exe for privilege escalation, and deploys Remcos RAT entirely in-memory for remote access, keylogging, and credential theft.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1443
- **ID:** TL-2026-1443
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Seqrite identified an active phishing campaign (first seen on VirusTotal July 6, 2026) impersonating India's Goods and Services Tax (GST) authority. The lure email, spoofed from 'donotreply.@gst.gov.in', uses the subject 'Refund Application GST RFD-01 filed vide ARN AL27052600952P' and carries a RAR attachment (GST-Refund_July-26_AL27052600952P.rar) containing a disguised .NET executable (GST-Refund_July-26_AL27052600952P.com).

The infection chain runs in five stages. Stage 1 is the initial .NET loader, which calls a function named ServiceChromatic() to reconstruct a 64,000-byte payload from the RGB channel values of a bundled bitmap image, iterating the pixel grid in column-major order, then loads the reconstructed assembly reflectively via Assembly.Load() — a bitmap-steganography technique that avoids storing the next stage as a conventional embedded resource. Stage 2, 'Windows Health Optimizer Plus.dll', is invoked with command-line-style parameters 'sStW' (bitmap processing) and 'inj' (injection), and uses XOR decryption keyed with UTF-16 Big Endian material to unpack the next stage. Stage 3, 'perfgurd.dll' (internally PerfGuard.dll), is loaded entirely in-memory and selects its execution method by reflection using an architecture-dependent method index (29 for x86, 15 for x64). When the process lacks administrative rights, the chain abuses cmstp.exe (Microsoft Connection Manager Profile Installer), a signed living-off-the-land binary, to respawn itself with elevated privileges. The final stage deploys Remcos RAT entirely in-memory — no RAT binary is written to disk.

Persistence is established by dropping a renamed copy of the loader to C:\Users\admin\AppData\Roaming\RVKLmPcYcNO.exe, generating a PowerShell script in a temp directory for hidden re-execution, and writing an HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry value pointing to that script so the chain restarts on every logon.

Once active, Remcos RAT grants the operator remote command execution, file upload/download and filesystem management, keystroke logging, credential harvesting from browsers and password stores, screen capture, remote-desktop-style control, process/service enumeration and manipulation, registry modification, and delivery of additional payloads over an encrypted C2 channel. Observed C2 infrastructure resolves to 185.242.4.122, hosted by M247 Europe SRL, fronted by dynamic-DNS domains hath.network and synology.me, with randomized subdomains such as aofmokighoig.hath.network — a disposable-infrastructure pattern typical of commodity RAT operators and access brokers rather than a state-nexus actor.

Seqrite and other researchers (ShomoySoft, CyberSecurityNews, GBHackers, K7 Labs) have documented closely related sibling campaigns using near-identical bitmap-steganography loader chains under GST/NEFT/RTGS/IMPS-themed lures, delivering not only Remcos but also Agent Tesla, Phantom Stealer, DarkCloud, RedLine Stealer, MassLogger variants, Formbook, XWorm, and Snake Keylogger — consistent with a loader-as-a-service model shared across multiple India-focused financially motivated operators. Attribution for this specific sample is assessed as an India-focused Remcos operator or Initial Access Broker; the tradecraft pattern echoes prior Seqrite-tracked activity such as 'Operation ShadowRecruit' (ControlR/Google-Sheets recruitment lures) and the China-nexus 'Operation DragonReturn' (DcRAT against India's Ministry of Finance), but no infrastructure or tooling overlap with either was established, keeping attribution confidence low.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1129 Shared Modules
- T1547.001 Registry Run Keys / Startup Folder
- T1036 Masquerading
- T1548.002 Bypass User Account Control
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1218.003 CMSTP
- T1620 Reflective Code Loading
- T1055 Process Injection
- T1056.001 Keylogging
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1021 Remote Services
- T1489 Service Stop

## Sources

- [Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain](https://www.seqrite.com/blog/behind-the-refund-from-gst-phishing-to-remcos-rat-through-a-multi-stage-net-infection-chain/)
- [Malicious GST Debit Note Attachment Deploys Remcos RAT Through Multi-Stage Loader](https://cybersecuritynews.com/malicious-gst-debit-note-attachment-deploys-remcos-rat/)
- [Malicious GST Debit Note Attachment Deploys Remcos RAT Through Multi-Stage Loader](https://blog.shomoysoft.com/en/post/malicious-gst-debit-note-attachment-deploys-remcos-rat)
- [Malicious GST Debit Note Attachment Deploys Remcos RAT Through Multi-Stage](https://teamwin.in/malicious-gst-debit-note-attachment-deploys-remcos-rat-through-multi-stage-loader/)
- [Hackers Use Steganographic Loader to Deliver Remcos RAT via Phishing Attachments](https://cyberpress.org/steganographic-loader-delivers-remcos/)
- [Multi-Stage Steganographic Loader Deploys Remcos RAT and Multiple Infostealers Globally](https://gbhackers.com/steganographic-loader-deploys-remcos-rat/)
- [A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally](https://labs.k7computing.com/index.php/a-multi-stage-steganographic-loader-campaign-deploying-diverse-payloads-globally/)
- [Cyber Swachhta Kendra: Remcos RAT Advisory](https://www.csk.gov.in/alerts/Remcos_RAT.html)
- [Fake Indian Tax Notice Campaign Delivers XWorm-Like RAT](https://www.mallory.ai/stories/019ef987-564e-79dc-a057-8add6dd51d8e)
- [Remcos RAT C2 Activity Mapped Along with The Ports Used for Communications](https://cybersecuritynews.com/remcos-rat-c2-activity-mapped/)
- [Deceptive Layoff-Themed HR Email Distributes Remcos RAT Malware](https://www.seqrite.com/blog/deceptive-layoff-themed-hr-email-distributes-remcos-rat-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1443