This campaign uses a malicious Microsoft-signed executable abused for DLL sideloading combined with a modified Microsoft DLL to execute ValleyRAT malware. It injects into the RuntimeBroker process and bypasses User Account Control (UAC) to maintain persistence and evade user prompts. The malware tampers with security products including Windows Defender, enabling keylogging, screenshot capture, and clipboard data theft. The infrastructure includes multiple command-and-control endpoints and a 15-subdomain delivery system with victim-specific links. The campaign targets Indian users with a GST filing-themed social engineering lure referencing the GSTR-3B filing deadline. Detailed reversing and infrastructure analysis with IOCs are publicly available.

The campaign compromises victim systems by installing ValleyRAT, enabling attackers to capture sensitive information such as keystrokes, screenshots, and clipboard contents. It also disables or interferes with security products, increasing the risk of prolonged undetected access. The use of multiple C2 endpoints and backup infrastructure suggests resilience and potential for widespread impact on targeted users.

No official patch or fix is applicable as this is a malware campaign rather than a software vulnerability. Defenders should apply recommended detection and response measures based on the published IOCs and infrastructure analysis. Users should be cautious of GST-themed phishing lures and avoid executing unexpected attachments or links. Security products should be kept updated, and behavioral detection tuned to identify DLL sideloading and process injection techniques described in the analysis.