PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks

A phishing campaign using a fake tax-audit notice is deploying VenomRAT through a signed copy of Notepad++. The operation, tracked as PAPERMILL, uses an email and a disk-image attachment to make a dangerous file look routine.

The attachment arrives with a tax-audit themed subject and can pass SPF, DKIM and DMARC checks. Opening it mounts what appears to be a local drive, allowing the malicious chain to start without warning labels carried by files downloaded from the internet.

Analysts at JUMPSEC identified the activity after reviewing a suspicious client email. They assessed PAPERMILL as an emerging cluster with tradecraft similar to the Silver Fox ecosystem, while stopping short of attributing it to that group.

JUMPSEC said in a report shared with Cyber Security News (CSN) that the campaign illustrates why a valid signature is not proof that an entire file set is safe.

It combines a familiar lure, a trusted application, a booby-trapped supporting file and an encrypted final payload, helping attackers slip past basic security controls. This approach complicates incident investigation and response for defenders.

PAPERMILL Hackers Abuse Signed Notepad++

The email directs recipients to a tax-notice-themed disk image. Once mounted, the container presents a renamed, legitimately signed application, a counterfeit library and an encrypted data file.

This technique can strip the internet-origin mark from the files inside, reducing the warnings Windows would normally display. The signed executable has not been altered. Instead, it is renamed and made to load the nearby malicious library.

This form of DLL sideloading lets harmful code run beside a trusted process, a pattern also seen in recent DLL sideloading campaigns.

The rogue DLL exposes only the functions the legitimate program expects, allowing the application to open normally while the loader works in the background.

It also uses misleading section names intended to confuse analysis tools, then decrypts its data file and launches the next stage from memory.

The loader checks whether the device resembles an automated analysis environment. Low memory, little free storage, a short uptime, an unmoved cursor or a low display resolution can trigger a five-minute delay rather than an immediate exit.

VenomRAT delivery and defensive steps

After the delay and privilege checks, the loader can seek administrator approval, create a RunOnce persistence entry and copy components into user-profile folders.

It then uses a Donut shellcode loader to run a .NET payload in memory. That layered design mirrors the disk-image VenomRAT delivery technique, but PAPERMILL adds a signed-program sideloading stage.

The recovered configuration identifies VenomRAT version 6.0.3 with hidden virtual network computing, data-stealing and file-grabbing capabilities.

Its server is configured for remote command traffic, creating a risk of account theft, surveillance and follow-on intrusion if a victim launches the attachment. Related samples and infrastructure suggest a campaign focused on Indian tax-themed targets.

Researchers found links to the broader Silver Fox-style playbook, including China-connected infrastructure and tax lures, but noted key differences in the chosen host program, loader and remote-access tool.

That caution matters: a shared technique can point to an ecosystem or copycat activity, rather than prove that one named actor ran the campaign.

Organizations should treat unsolicited tax notices and unexpected disk-image files as high risk, even when an email passes authentication checks.

Staff should independently verify tax-related requests through known channels, while security teams should block or closely inspect IMG and ISO files delivered by email and investigate unusual mounted drives.

Defenders should also alert on signed applications loading unexpected DLLs from user-writable folders, unfamiliar RunOnce entries and suspicious network connections from trusted or system-lookalike processes.

These controls complement lessons from SilverFox trusted software abuse and can expose the behavior that per-download file hashes may miss.

Because PAPERMILL can generate fresh containers, hashes alone are unlikely to provide durable coverage. Hunting for loader file relationships, library naming patterns, persistence locations and command traffic gives responders stronger ways to find infections and contain them before attackers expand access.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Sender address / DKIM domain	dfgfasd@hsaui[.]cc	Observed sender address and DKIM domain
Sending IP	155.94.154.195	Sending infrastructure IP address
Sending MTA	mos1.17dlz[.]cn	HELO/PTR value for the sending mail transfer agent
Bulk-mailer auth host	smtp.smtpman[.]cn	Mailer authentication host
Payload / landing URL	hxxps://dsfgssd[.]uk[.]cc/	Initial payload hosting location
Payload / landing URL	hxxps://dsfgssd[.]uk[.]cc/download[.]php	Download endpoint for the payload
Tracking-beacon path	/api/mailer/open?task=<GUID>&t=<token>	Beacon path, with host left as localhost:6688
Lure subject	कर लेखापरीक्षा परिणाम No. ITD/SCNU/2026-<seq>	Tax-audit themed phishing subject
Mailer tell	{{seq}}	Unrendered variable in the From display name
SHA-256	f945b3f2f29d62099683cbbf069ed5bc952d089c16a85fb314ac8fe0f0c10d2b	Tax_Notice_45594.img ISO container
SHA-256	fe0ddd8686324e0a8b07ed5ffdb4f56397c70b1b5a19d2916c8eb192583f950c	Tax_Notice_45594.exe signed launcher
SHA-256	8c1ba078598e09294d72293a42dcd878e183b6e5a207315f7bf6ef74a966cbb5	libcurl.dll proxy loader
SHA-256	2ff898c1a4bb0dd48687bbbc8cca646a896dc9ed24780a49523dfbf9fb94a4ec	LIBCURL.DAT encrypted payload
SHA-256	947221d0f1e2c9c09028491997406dd9f0cb5b65258556c86d201ec1ca538f5f	stage2.dll VenomRAT .NET DLL
Install directory	%APPDATA%\Microsoft\Crypto\RuntimeBroker\	Loader installation directory
VenomRAT runtime directory	%APPDATA%\MyData\	Runtime folder used by the RAT
Dropped files	RuntimeBroker.exe, libcurl.dll, libcurl.dat	Loader-stage files placed on disk
Staging temporary names	*_dbg_src.tmp, *_dbg_dst.tmp	Temporary staging file patterns
Persistence key	HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce → …\RuntimeBroker\RuntimeBroker.exe	Registry RunOnce persistence
Masquerade	RuntimeBroker.exe	Impersonates Windows Runtime Broker
Internal DLL name	libcurl.dll_38768.dll	Hunt pattern: libcurl.dll_<digits>.dll
Loader module base	0x00000002FFF20000	Fixed memory mapping inside the affected process
Loader section names	.nvdata ×3, .nvtext, .pdata	Misleading PE section names, with no exception directory
VenomRAT mutex	xkoqvgcojtqgi	Mutex used by the VenomRAT payload
VenomRAT HVNC worker	cvtres.exe	Process targeted by the payload on reconnect
C2 endpoint	154.36.188.201:4449	VenomRAT command-and-control endpoint
VenomRAT campaign group	Default	Group value in the recovered configuration
VenomRAT master key	cFlrTU1YN25QN2lkc05ZWDJVWkY0R1FtUUcyNmgyY1Y=	Base64 key that decodes to pYkMMX7nP7idsNYX2UZF4GQmQG26h2cV
PBKDF2 salt	VenomRATByVenom	Configuration-decryption salt
Version banner	Venom RAT + HVNC + Stealer + Grabber v6.0.3	Version string, including two spaces before v6.0.3
Server X.509 subject / issuer	CN=VenomRAT / C=CN, L=SH, O=VenomRAT By qwqdanchun, OU=qwqdanchun, CN=LMTEAM Server	Certificate metadata tied to the builder
SHA-1 thumbprint	009a05eaf082d20ae13a65abda12afd959cd76de	Pivot hash associated with the modified v6.0.3 builder
SHA-256 thumbprint	f72bf7c1fd132262715820d839e4874c97d927b10072fb4709a1321927fea66d	Builder certificate SHA-256 thumbprint
SHA-256	72a321802d738e8bc6a0ab9d9d24b380be944fffbfc85094b889690b679a73c2	Related sample: ClientAny.exe / skkr3.exe
SHA-256	268a90d07cf02b16c091ef6cc52e3dbe17638bb722221807bc833c4c1299a8a9	Related sample: Tax_Notice_16695 (1).img
SHA-256	f23708ae470904490cb25d370185ca89c0d37e33fa5a3c652e4b10e65d0b08e3	Related sample: ITDENF2026-4281.img
SHA-256	d768222934f6014bf17c3d0a1ef4c35e02aa6fe1e89564e252ca5e7b7c7fe237	Related sample: Tax_436454367.img
SHA-256	0c0e4935f8df04e86056798d417bf3f485c640fa0322756c0a860af2a6bd0f1d	Related 2023 Chinese-language sample
SHA-256	38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c	Related sample: Tax_Notice_23665.img
SHA-256	a4098fe9ed421a6244c9fd4d3d1a632ff5f2ee4ffa204dff0587548932936d38	Related sample: Tax_Notice_99674.img
Sister lure domain	dgdskfds[.]uk[.]cc	Related lure domain in July 2026 waves
Sister delivery host	aidenllc[.]com	Related delivery host
Sister delivery host	gov-xnui[.]com	Related delivery host
Sister delivery host	xjxfxn[.]com	Related delivery host
Sister delivery host	jfbcea[.]com	Related delivery host
DGA domain cluster	tzawccsw[.]xin, zxizusuy[.]xin, zasudtytw[.]xin, zixhasda[.]xin, pzisiauywa[.]xin, gisudyawz[.]ink	Domains resolving to 103.23.172.15
Sister lure title	कर दंड सूचना – भारत सरकार	Tax Penalty Notice, Government of India lure
Secondary C2 IP	103.119.15.189	C2 address used by a sibling sample
Related certificate domain	ekl1-neettr[.]bond	Domain linked to the sender IP 155.94.154.195

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC