Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver a remote access trojan designed to steal sensitive data from compromised hosts. The multi-stage campaign, codenamed Operation DragonReturn by Seqrite Labs, involves sending spear-phishing emails impersonating the Income Tax Department of India. …

https://thehackernews.com/2026/07/suspected-china-nexus-hackers-use-fake.html

sha256:ecb6b780194a0cd89abf57d86e1848507cae348952d3053a8af59652cd302d0f

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve2
md50
url0
ipv42
ipv60
sha10
domain5
sha2560
malware_token1
attack_pattern0
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	explorer.exe	Open →
ip	204.194.48.250	Open →
ip	223.26.63.40	Open →
domain	govtop.one	Open →
domain	kkxqbh.top	Open →
cve	CVE-2026-46817	Open →
cve

Malware families

Allowlist token matches only.

Metasploitmalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

Turla

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports