Operation DragonReturn: China-Nexus APT Deploys DcRAT Against Indian Tax Infrastructure — 0/66 VirusTotal Detections, Payload Rotation Active

Seqrite Labs has disclosed Operation DragonReturn, a sustained China-nexus spear-phishing campaign active since May 18, 2026 that targets Indian taxpayers, chartered accountants, and corporate finance teams by impersonating the Income Tax Department of India during the AY2026-27 ITR filing season. The multi-stage chain delivers DcRAT via a fake government utility filename (Common_Offline_Utility_ITR-1_to_4_AY2026-27.zip), with payload injected into svchost.exe via AMSI bypass and a fileless .NET assembly loaded in memory; the latest variant achieved 0/66 VirusTotal detections as of June 12, with C2 traffic over TLS to 223.26.63.40:2671. Attribution is assessed medium-to-high confidence to a China-aligned cluster based on infrastructure overlaps with Silver Fox TTPs, Chinese-language artifacts, and a parallel campaign (TAX#TRIDENT) delivering ValleyRAT via DLL hijacking through the same tax-season lure theme.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.