ChinaNet IPs and Silver Fox Overlaps Mark DcRAT Campaign Targeting Indian Tax Filers Since May 2026
China-linked actors used precision tax-themed phishing to install DcRAT via fake Indian government utilities. Evidence shows ChinaNet infrastructure and Silver Fox overlaps but lacks independent state attribution. The campaign targets high-value financial data during annual filing season with tested persistence techniques.
The campaign used bilingual PDFs with real legal citations and urgency lures around tax penalties, directing victims to govtop[.]one/incometax. The archive executed a UAC bypass, extracted a 504 KB DLL from an embedded JPG, and registered MixedSvc for persistence. Seqrite observed anti-analysis checks and AMSI disablement before DcRAT deployment for screenshot and credential theft.
Infrastructure ties include ChinaNet-routed IPs and a Chinese-language C2 panel at 223.26.63[.]40. Tactical matches with Silver Fox ValleyRAT operations, including identical tax-themed lures and DLL sideloading, appear in contract records and prior Seqrite telemetry. LevelBlue detections of parallel LINE installer and salary phishing campaigns using the same RAT family indicate resource sharing rather than isolated activity.
The operation exploits the predictable April-July filing window and limited verification of official utilities. No independent technical attribution beyond IP and panel language has surfaced; Seqrite's China-nexus label rests on infrastructure correlation without claimed nation-state tasking.
Expect rotation of new domains and payload containers ahead of next filing cycle, with continued focus on finance teams holding bulk PAN and ITR data.
Seqrite Labs: At least two new tax-lure domains registered and active by March 2027.
Sources (3)
- [1]Seqrite Labs Operation DragonReturn Report(https://seqrite.com/blog/operation-dragonreturn)
- [2]LevelBlue ValleyRAT Campaign Analysis(https://levelblue.com/threat-intelligence/valleyrat-line-installer)
- [3]The Hacker News Coverage 2026(https://thehackernews.com/2026/07/suspected-china-nexus-hackers-use-fake.html)