China-Nexus APT Targets India With Fake Tax Assessment Campaign Using DLL Hijacking

Date: 07/07/2026

Severity: High

Summary

Researchers identified a social engineering campaign impersonating the Indian Income Tax Department to deliver the ValleyRat Remote Access Trojan (RAT) through a multi-stage infection chain involving a malicious VHDX, DLL SideLoading, and encrypted in-memory payload execution. The malware employs advanced defense-evasion techniques, including runtime string decryption, API hashing, process injection, and registry persistence, while dynamically downloading additional encrypted modules from its C2 server to extend functionality. The campaign highlights the increasing use of government-themed phishing, layered malware delivery, and fileless execution to evade detection and establish persistent remote access to compromised systems.

Indicators of Compromise (IOC) List   

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Reference:  

https://cyberarmor.tech/blog/china-nexus-apt-india-tax-assessment-dll-hijacking