Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Key Findings
- Fake Indian Income Tax Department websites trick users into downloading malware disguised as a tax utility.
- The malware uses a trusted, signed Windows binary to load a malicious DLL, bypassing initial trust checks.
- A six-stage infection chain delivers two separate remote access tools, each connecting to a different command-and-control server.
- The final implants are a Gh0st RAT derivative and a Quasar/AsyncRAT-family payload, both running entirely in memory.
- The dual-implant design gives the attacker redundant access even if one channel is blocked or detected.
Summary
The Howler Cell Threat Research Team identified an active malware campaign targeting Indian users. The attack starts with fake websites impersonating the Indian Income Tax Department. Victims see urgent tax compliance notices, get routed through a fake Microsoft security page, and download a ZIP file that looks like an official tax tool.
Article Link: https://www.cyderes.com/howler-cell/fake-indian-itr-notice-dual-rat-deployment