This threat involves a targeted phishing campaign that impersonates the Indian Income Tax Department to deceive local businesses into opening spear-phishing emails containing PDF attachments. These PDFs direct victims to a counterfeit compliance portal designed to appear legitimate, which then triggers the download of a malicious ZIP archive. The ZIP file contains NSIS (Nullsoft Scriptable Install System) installers that execute a multi-stage infection chain culminating in the deployment of a Remote Access Trojan (RAT). This RAT establishes persistence on the infected system, enabling continuous unauthorized access. It harvests detailed system information and communicates with command and control (C2) servers to receive instructions and exfiltrate data. The infection chain leverages multiple MITRE ATT&CK techniques such as spear-phishing (T1566.002, T1566.001), persistence via service creation (T1543.003), masquerading (T1036), and data staging (T1074). Indicators of compromise include a specific file hash (4001854be1ae8e12b6dda124679a4077), an IP address (154.91.84.3), and a malicious domain (www.akjys.top). Attribution is uncertain, but technical evidence suggests a China-linked development environment. The campaign exemplifies how tax-themed social engineering can lead to full device compromise, emphasizing the need for vigilance against targeted phishing attacks.

For European organizations, the direct impact may be limited due to the campaign’s focus on Indian local businesses. However, European companies with subsidiaries, partners, or clients in India could be at risk if employees receive similar phishing emails or if attackers pivot through compromised Indian entities. The RAT’s capabilities for persistent remote access and data harvesting pose significant risks to confidentiality, integrity, and availability of affected systems. Compromise could lead to intellectual property theft, espionage, or lateral movement within networks. Additionally, the use of sophisticated multi-stage infection chains increases the difficulty of detection and remediation. The campaign also highlights the broader threat of supply chain or third-party risk, where European firms connected to Indian businesses might face indirect exposure. Overall, the threat underscores the importance of defending against targeted phishing and malware campaigns that exploit regional tax themes.

1. Implement advanced email filtering and sandboxing to detect and block spear-phishing emails and malicious attachments, especially PDFs and ZIP files. 2. Conduct targeted security awareness training focusing on tax-themed phishing and spear-phishing tactics, emphasizing verification of unexpected tax-related communications. 3. Employ endpoint detection and response (EDR) solutions capable of identifying NSIS installer usage, persistence mechanisms, and unusual outbound network connections to suspicious domains or IPs. 4. Monitor network traffic for communications to known malicious infrastructure such as the domain www.akjys.top and IP 154.91.84.3, and block these at the firewall or proxy level. 5. Enforce application whitelisting to prevent unauthorized execution of installers and unknown binaries. 6. Regularly audit and restrict service creation privileges to limit persistence opportunities for malware. 7. Maintain up-to-date threat intelligence feeds to detect emerging phishing campaigns and indicators of compromise. 8. Establish incident response procedures to quickly isolate and remediate infected systems. 9. For organizations with Indian business ties, implement additional scrutiny on tax-related communications and verify authenticity through official channels. 10. Use multi-factor authentication and network segmentation to reduce the impact of potential RAT infections.