This threat involves a phishing campaign targeting Indian entities by impersonating the Indian Income Tax Department. The attack delivers a ZIP archive containing a legitimately signed Overwolf executable alongside a malicious DLL and an encrypted binary. The signed executable side-loads the malicious DLL through DLL hijacking. The DLL, packed with UPX and modified with Astral-PE, decrypts an embedded ValleyRAT payload using a modified RC4 encryption with a 115-byte key. ValleyRAT runs entirely in memory, establishes persistence via scheduled tasks masquerading as OneDrive entries, marks its files as hidden and system, and performs process hollowing into svchost.exe to evade detection before connecting to its command and control servers.

The campaign enables attackers to deploy ValleyRAT malware on victim systems, allowing persistent remote access and stealthy operation through process hollowing and file hiding. This compromises the confidentiality and integrity of affected systems within targeted Indian organizations, potentially leading to data theft or further malicious activity. The use of a legitimately signed binary for DLL sideloading increases the likelihood of bypassing security controls.

No official patch or remediation is indicated for this threat. Mitigation should focus on user awareness to recognize phishing attempts impersonating tax authorities, blocking malicious URLs and ZIP attachments at email gateways, and monitoring for suspicious scheduled tasks and process hollowing behaviors. Endpoint detection solutions should be tuned to detect DLL sideloading and in-memory execution techniques. Since the signed Overwolf binary is abused, verifying the integrity of executables and restricting execution of unexpected binaries may help reduce risk.