Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment

A highly sophisticated, China-aligned cyber-espionage campaign is actively targeting India’s tax infrastructure and taxpayers with multi-stage, fileless DcRAT malware—delivered via convincing spear-phishing lures exploiting the ITR filing season—achieving stealthy persistence, AMSI bypass, encrypted C2, and zero antivirus detection, all with the clear objective of long-term intelligence collection and data exfiltration.