Threats Tagged 'fileless execution'

Operation DragonReturn is a medium-severity cyber espionage campaign attributed to a China-aligned threat actor targeting India's Ministry of Finance tax infrastructure during the AY2026-27 income tax filing season. The campaign uses spear-phishing emails impersonating government entities to deliver a multi-stage infection chain deploying DcRAT malware. Techniques include steganographic payload concealment, fileless .NET execution, AMSI bypass, and Windows service persistence. The threat actor employs encrypted TLS communications and rotates payloads to evade detection. The campaign focuses on corporate entities, tax professionals, and taxpayers in India, aiming to collect intelligence and exfiltrate data.

MediumMalwareBritish Indian Ocean TerritoryIndia#china-nexus#income tax impersonation#spear-phishing

A multi-stage phishing campaign emerged in early May 2026, impersonating LinkedIn and Indeed through typosquatted domains to deliver malicious payloads. The attack chain begins with fake CAPTCHA pages distributed via Google Ads, leveraging the legacy Finger protocol and native Windows utilities. Victims are tricked into executing commands that deploy portable Python runtimes (CPython or IronPython), which then execute in-memory shellcode. The campaign delivers CastleLoader, a Malware-as-a-Service framework using ChaCha20 and RC4 encryption for C2 communications, followed by a Python-based remote access trojan. The RAT provides interactive shell control, in-memory payload execution, and persistence mechanisms. The campaign represents an evolution of browser-based social engineering, combining Living-off-the-Land binaries with Python-based delivery to maintain a fileless footprint and evade detection through legitimate system utilities.