The original title is: "Operation DragonReturn: DcRAT Deployment via Fake ITR Utilities"

Short summary

Seqrite Labs tracks Operation DragonReturn, a sophisticated DcRAT campaign impersonating India's Income Tax Department to target tax professionals and corporate finance teams. The multi-stage attack chains spear-phishing with credential theft, persistence, and lateral movement to exfiltrate financial records. Defense requires monitoring for suspicious process execution, registry persistence, and DcRAT's characteristic 5-60 second C2 beacon patterns.

• •DcRAT campaign exploits India's March 31 tax filing deadline with Income Tax Department impersonation phishing
• •Attack chains MITRE ATT&CK techniques: spear-phishing → credential theft → persistence → lateral movement → data exfiltration
• •Detection: monitor svchost.exe child processes, HKLM registry Run keys, and encrypted C2 beacon intervals

Generated with AI, which can make mistakes.