This threat involves a multi-stage infection chain initiated by a phishing campaign themed around GST refund notifications targeting Indian entities. The initial vector is a malicious RAR archive containing a .NET executable that conceals payloads using bitmap-based steganography. The infection progresses through stages involving DLLs such as Windows Health Optimizer Plus.dll and perfgurd.dll, culminating in the in-memory deployment of Remcos RAT. Persistence is achieved through PowerShell scripts and registry changes. The command-and-control infrastructure leverages dynamic DNS with randomized subdomains under aofmokighoig.hath.network. The deployed Remcos RAT provides capabilities including remote command execution, keylogging, credential harvesting, file manipulation, and extensive system reconnaissance. The campaign is financially motivated and specifically targets Indian businesses and taxpayers.

The deployed Remcos RAT enables attackers to execute remote commands, log keystrokes, harvest credentials, manipulate files, and perform comprehensive reconnaissance on infected systems. This can lead to data theft, unauthorized access, and potential financial loss for targeted organizations and individuals. The infection chain uses fileless execution techniques and persistence mechanisms that complicate detection and removal.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Defenders should be aware of phishing campaigns impersonating GST refund notifications and avoid opening unsolicited RAR archives or executables. Monitoring for indicators such as the identified hashes and suspicious PowerShell activity may aid detection. Since the malware uses fileless execution and registry persistence, endpoint detection and response solutions with behavioral analysis capabilities are recommended. No official fix or patch is currently indicated.