PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks
AI summary · glm-5.3-flashSummaries by Vani AI
PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.
JUMPSEC tracks PAPERMILL as an emerging cluster whose emails pass SPF, DKIM, and DMARC and deliver tax-audit themed disk images. The mounted image pairs a legitimately signed, renamed executable with a rogue libcurl.dll for DLL sideloading, then uses a Donut shellcode loader to run VenomRAT 6.0.3 in memory with hidden VNC, data-stealing, and file-grabbing capabilities. The loader includes anti-analysis checks and RunOnce persistence, and lures plus China-connected infrastructure overlap with the Silver Fox ecosystem, though attribution remains unconfirmed.
Key facts
- Emails pass SPF/DKIM/DMARC and deliver tax-notice disk images that strip internet-origin warnings
- Renamed signed Notepad++ launcher loads rogue libcurl.dll via DLL sideloading
- Donut shellcode runs VenomRAT 6.0.3 in memory with VNC, data theft, and file grabbing
- Anti-analysis checks trigger a five-minute delay on low memory, short uptime, or unmoved cursor
- Tradecraft overlaps the Silver Fox ecosystem with Chinese infrastructure and Indian tax lures
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 17dlz.cn | .154.195 Sending infrastructure IP address Sending MTA mos1.17dlz[.]cn HELO/PTR value for the sending mail transfer agent Bulk-m |
| domain | aidenllc.com | Related lure domain in July 2026 waves Sister delivery host aidenllc[.]com Related delivery host Sister delivery host gov-xnui[.]com |
| domain | dgdskfds.uk.cc | d38 Related sample: Tax_Notice_99674.img Sister lure domain dgdskfds[.]uk[.]cc Related lure domain in July 2026 waves Sister delivery |
| domain | dsfgssd.uk.cc | cn Mailer authentication host Payload / landing URL hxxps://dsfgssd[.]uk[.]cc/ Initial payload hosting location Payload / landing URL |
| domain | ekl1-neettr.bond | address used by a sibling sample Related certificate domain ekl1-neettr[.]bond Domain linked to the sender IP 155.94.154.195 Note: IP ad |
| domain | gisudyawz.ink | xin , zasudtytw[.]xin , zixhasda[.]xin , pzisiauywa[.]xin , gisudyawz[.]ink Domains resolving to 103.23.172.15 Sister lure title कर द |
| domain | gov-xnui.com | t aidenllc[.]com Related delivery host Sister delivery host gov-xnui[.]com Related delivery host Sister delivery host xjxfxn[.]com R |
| domain | hsaui.cc | Indicator Description Sender address / DKIM domain dfgfasd@hsaui[.]cc Observed sender address and DKIM domain Sending IP 155.94 |
| domain | jfbcea.com | ost xjxfxn[.]com Related delivery host Sister delivery host jfbcea[.]com Related delivery host DGA domain cluster tzawccsw[.]xin , |
| domain | pzisiauywa.xin | .]xin , zxizusuy[.]xin , zasudtytw[.]xin , zixhasda[.]xin , pzisiauywa[.]xin , gisudyawz[.]ink Domains resolving to 103.23.172.15 Sist |
| domain | smtpman.cn | the sending mail transfer agent Bulk-mailer auth host smtp.smtpman[.]cn Mailer authentication host Payload / landing URL hxxps:// |
| domain | tzawccsw.xin | host jfbcea[.]com Related delivery host DGA domain cluster tzawccsw[.]xin , zxizusuy[.]xin , zasudtytw[.]xin , zixhasda[.]xin , pzi |
| domain | xjxfxn.com | t gov-xnui[.]com Related delivery host Sister delivery host xjxfxn[.]com Related delivery host Sister delivery host jfbcea[.]com R |
| domain | zasudtytw.xin | y host DGA domain cluster tzawccsw[.]xin , zxizusuy[.]xin , zasudtytw[.]xin , zixhasda[.]xin , pzisiauywa[.]xin , gisudyawz[.]ink Dom |
| domain | zixhasda.xin | cluster tzawccsw[.]xin , zxizusuy[.]xin , zasudtytw[.]xin , zixhasda[.]xin , pzisiauywa[.]xin , gisudyawz[.]ink Domains resolving to |
| domain | zxizusuy.xin | m Related delivery host DGA domain cluster tzawccsw[.]xin , zxizusuy[.]xin , zasudtytw[.]xin , zixhasda[.]xin , pzisiauywa[.]xin , g |
| ipv4 | 103.119.15.189 | ax Penalty Notice, Government of India lure Secondary C2 IP 103.119.15.189 C2 address used by a sibling sample Related certificate dom |
| ipv4 | 103.23.172.15 | n , pzisiauywa[.]xin , gisudyawz[.]ink Domains resolving to 103.23.172.15 Sister lure title कर दंड सूचना – भारत सरकार Tax Penalty Not |
| ipv4 | 154.36.188.201 | xe Process targeted by the payload on reconnect C2 endpoint 154.36.188.201:4449 VenomRAT command-and-control endpoint VenomRAT campaig |
| ipv4 | 155.94.154.195 | aui[.]cc Observed sender address and DKIM domain Sending IP 155.94.154.195 Sending infrastructure IP address Sending MTA mos1.17dlz[.] |
| sha1 | 009a05eaf082d20ae13a65abda12afd959cd76de | r Certificate metadata tied to the builder SHA-1 thumbprint 009a05eaf082d20ae13a65abda12afd959cd76de Pivot hash associated with the modified v6.0.3 builder SHA- |
| sha256 | 0c0e4935f8df04e86056798d417bf3f485c640fa0322756c0a860af2a6bd0f1d | 252ca5e7b7c7fe237 Related sample: Tax_436454367.img SHA-256 0c0e4935f8df04e86056798d417bf3f485c640fa0322756c0a860af2a6bd0f1d Related 2023 Chinese-language sample SHA-256 38ec1f5e23f65b |
| sha256 | 268a90d07cf02b16c091ef6cc52e3dbe17638bb722221807bc833c4c1299a8a9 | b679a73c2 Related sample: ClientAny.exe / skkr3.exe SHA-256 268a90d07cf02b16c091ef6cc52e3dbe17638bb722221807bc833c4c1299a8a9 Related sample: Tax_Notice_16695 (1).img SHA-256 f23708ae47 |
| sha256 | 2ff898c1a4bb0dd48687bbbc8cca646a896dc9ed24780a49523dfbf9fb94a4ec | e5a207315f7bf6ef74a966cbb5 libcurl.dll proxy loader SHA-256 2ff898c1a4bb0dd48687bbbc8cca646a896dc9ed24780a49523dfbf9fb94a4ec LIBCURL.DAT encrypted payload SHA-256 947221d0f1e2c9c090284 |
| sha256 | 38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c | 860af2a6bd0f1d Related 2023 Chinese-language sample SHA-256 38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c Related sample: Tax_Notice_23665.img SHA-256 a4098fe9ed421a |
| sha256 | 72a321802d738e8bc6a0ab9d9d24b380be944fffbfc85094b889690b679a73c2 | 321927fea66d Builder certificate SHA-256 thumbprint SHA-256 72a321802d738e8bc6a0ab9d9d24b380be944fffbfc85094b889690b679a73c2 Related sample: ClientAny.exe / skkr3.exe SHA-256 268a90d07 |
| sha256 | 8c1ba078598e09294d72293a42dcd878e183b6e5a207315f7bf6ef74a966cbb5 | 8eb192583f950c Tax_Notice_45594.exe signed launcher SHA-256 8c1ba078598e09294d72293a42dcd878e183b6e5a207315f7bf6ef74a966cbb5 libcurl.dll proxy loader SHA-256 2ff898c1a4bb0dd48687bbbc8c |
| sha256 | 947221d0f1e2c9c09028491997406dd9f0cb5b65258556c86d201ec1ca538f5f | 80a49523dfbf9fb94a4ec LIBCURL.DAT encrypted payload SHA-256 947221d0f1e2c9c09028491997406dd9f0cb5b65258556c86d201ec1ca538f5f stage2.dll VenomRAT .NET DLL Install directory %APPDATA%\Mi |
| sha256 | a4098fe9ed421a6244c9fd4d3d1a632ff5f2ee4ffa204dff0587548932936d38 | 7e44e6a998e04c Related sample: Tax_Notice_23665.img SHA-256 a4098fe9ed421a6244c9fd4d3d1a632ff5f2ee4ffa204dff0587548932936d38 Related sample: Tax_Notice_99674.img Sister lure domain dgd |
| sha256 | d768222934f6014bf17c3d0a1ef4c35e02aa6fe1e89564e252ca5e7b7c7fe237 | e4b10e65d0b08e3 Related sample: ITDENF2026-4281.img SHA-256 d768222934f6014bf17c3d0a1ef4c35e02aa6fe1e89564e252ca5e7b7c7fe237 Related sample: Tax_436454367.img SHA-256 0c0e4935f8df04e86 |
| sha256 | f23708ae470904490cb25d370185ca89c0d37e33fa5a3c652e4b10e65d0b08e3 | 4c1299a8a9 Related sample: Tax_Notice_16695 (1).img SHA-256 f23708ae470904490cb25d370185ca89c0d37e33fa5a3c652e4b10e65d0b08e3 Related sample: ITDENF2026-4281.img SHA-256 d768222934f6014 |
| sha256 | f72bf7c1fd132262715820d839e4874c97d927b10072fb4709a1321927fea66d | ociated with the modified v6.0.3 builder SHA-256 thumbprint f72bf7c1fd132262715820d839e4874c97d927b10072fb4709a1321927fea66d Builder certificate SHA-256 thumbprint SHA-256 72a321802d73 |
| sha256 | f945b3f2f29d62099683cbbf069ed5bc952d089c16a85fb314ac8fe0f0c10d2b | {seq}} Unrendered variable in the From display name SHA-256 f945b3f2f29d62099683cbbf069ed5bc952d089c16a85fb314ac8fe0f0c10d2b Tax_Notice_45594.img ISO container SHA-256 fe0ddd8686324e0a |
| sha256 | fe0ddd8686324e0a8b07ed5ffdb4f56397c70b1b5a19d2916c8eb192583f950c | 14ac8fe0f0c10d2b Tax_Notice_45594.img ISO container SHA-256 fe0ddd8686324e0a8b07ed5ffdb4f56397c70b1b5a19d2916c8eb192583f950c Tax_Notice_45594.exe signed launcher SHA-256 8c1ba078598e09 |
| url | https://dsfgssd.uk.cc/ | tpman[.]cn Mailer authentication host Payload / landing URL hxxps://dsfgssd[.]uk[.]cc/ Initial payload hosting location Payload / landing URL |
| url | https://dsfgssd.uk.cc/download.php | ]cc/ Initial payload hosting location Payload / landing URL hxxps://dsfgssd[.]uk[.]cc/download[.]php Download endpoint for the payload Tracking-beacon pat |
From the original article
5 min read at cybersecuritynews.com
A phishing campaign using a fake tax-audit notice is deploying VenomRAT through a signed copy of Notepad++. The operation, tracked as PAPERMILL, uses an email and a disk-image attachment to make a dangerous file look routine. The attachment arrives with a tax-audit themed subject and can pass SPF, DKIM and DMARC checks.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.