Operation DragonReturn

Naming: this pack is filed under Operation DragonReturn (Seqrite Labs' name). The same campaign is reported elsewhere as the fake Indian ITR notice chain (Cyderes Howler Cell) and as the fake Indian tax filing utility / DcRAT campaign (The Hacker News). All three names describe one operation — same COU_ITR lure, same nvdaHelperRemote.dll side-load, same kkxqbh[.]top and 118.107.0.197 infrastructure. Both names are recorded here deliberately so future triage does not treat them as two threats.

Two vendors independently documented the same campaign against India's tax-filing ecosystem during the AY2026-27 season. Seqrite Labs published it as Operation DragonReturn (first observed 2026-05-18, spear-phishing PDFs linking to govtop[.]one/incometax), and Cyderes' Howler Cell published a deeper reverse-engineering writeup on 2026-07-07 covering a parallel set of lure domains. The two clusters are the same operation: they share the stage-1 DLL hash 2c0de3d5…, the polyglot host 118[.]107[.]0[.]197, and the C2 domain kkxqbh[.]top.

Victims reach a fake Income Tax Department page that abuses Government of India branding, are routed through a bogus "Microsoft Edge Secure Gateway" verification screen, and are served Common_Offline_Utility_ITR-1_to_4_AY2026-27.zip. The archive holds a legitimate, digitally signed executable, COU_ITR-1_to_4_AY2026-27.exe, alongside a malicious companion DLL, nvdaHelperRemote.dll — a name borrowed from the NVDA screen reader. Windows' default DLL search order does the rest: the trusted, signed process loads attacker code with no exploit and no unsigned parent.

From there a six-stage chain runs. Stage 2 checks for Administrators-group membership and re-launches itself with the runas verb to force a UAC prompt; it then stages under C:\Program Files\Windows Media Player\, copies itself to Mixed Reality.exe, and installs an auto-start service MixedSvc with the display name "Windows Mixed Reality Service". It fetches a polyglot JPEG to C:\Windows\background.jpg — a file that renders as a valid image in any browser but carries at least three distinct encrypted payloads appended at different byte offsets. Stages 3 through 5 move entirely into memory via reflective loading, and stage 5 is session-aware: it enumerates every active terminal session and spawns a suspended svchost.exe under a token whose session ID has been reassigned, injecting into each one. The malware therefore reaches every logged-in user, not just the service session.

The two final implants split their C2 deliberately. Stage 6A is a Gh0st RAT derivative reaching kkxqbh[.]top on port 6666, carrying reflectively-loaded zlib, CameraUtil, libturbojpeg and a custom VTCP.dll stack for a self-contained screen-capture-to-JPEG exfil pipeline plus a piped cmd.exe reverse shell. Stage 6B patches AMSI (AmsiOpenSession +0x1C overwritten with 0xFEEB), hosts the CLR from native code, and loads a Quasar/AsyncRAT-family .NET assembly in memory that reaches ouewop[.]com on port 6351. Blocking one channel does not end the intrusion.

Attribution is SUSPECTED, not confirmed. Seqrite assesses with medium-to-high confidence that this is a China-aligned cluster, based on Chinese-language strings in the infrastructure, a Chinese-language DCRat web panel on 223.26.63[.]40, kkxqbh[.]top resolving into ChinaNet AS4134 (Nanchang, Jiangxi), and infrastructure/TTP overlaps with Silver Fox — a Chinese cybercrime group previously tied to tax-themed ValleyRAT phishing. Seqrite itself notes that hosting geography alone is not definitive attribution. Treat "China-nexus" and "Silver Fox overlap" as an analytic assessment, not established fact, in any reporting derived from this pack.

Defender priority: run Q3 first — any PE written into C:\Program Files\Windows Media Player\ is the campaign's highest-fidelity, lowest-false-positive artifact. Windows Media Player is a frozen legacy component; nothing legitimate drops executables there. Pair it with Q4 (the MixedSvc service) and Q8 (svchost.exe egress on 6666/6351) for staging-through-C2 coverage that survives hash and domain rotation.

Eight sources were fetched and snapshotted verbatim to OperationDragonReturn-Hunt-sources/. Every atomic indicator shipped in section 10 traces to one of those snapshots; nothing was inferred, reconstructed, or carried from memory.

Research notes and deliberate exclusions

• 93dd8b7b… ships as detect, never prevent. That hash is the legitimate, digitally signed Income Tax Department offline utility (also seen renamed to Mixed Reality.exe). It is abused, not malicious. Setting it to prevent would break the genuine ITR filing tool for any Indian-market user and would be a self-inflicted outage. Detect-only, and triage on where it runs from — see Q1 and Q10.
• C2 ports 6666 and 6351 are not shipped in the import CSV. Falcon IOC Management has no port indicator type. They are carried in the behavioural block and are enforced through Q8 instead.
• The AES-128 key 3343f6a8… is not shipped as an MD5. It is a 16-byte hardcoded decryption key from the stage-6B loader that happens to be 32 hex characters. Labelling it a hash would produce a permanently-zero-hit IOC. It lives in the behavioural block as a reverse-engineering aid.
• Host artifacts c:\kkooPPP, c:\ouewo, c:\kkqqexit and c:\debug.txt are behavioural, not CQL-queryable. Falcon file-write telemetry covers PE, ELF, archive and document writes; these are extension-less, non-PE lock and kill files, so no *FileWritten event fires. They are handled in the native audit-log hunts (section 7) and flagged as a coverage gap (section 15).
• Named kernel objects are not blockable. Global\kkctsbnn, Global\ShitSetupOn26126k and the AsyncRAT mutex 5sGEm6Q4eTNv are excellent DFIR confirmation pivots on a live host but have no Falcon indicator type and no standard sensor event. Behavioural block plus section 7.
• Perishability: the five IPv4 addresses and the lure domains rotate fastest and carry the shortest expiry. The 43 SHA256 values are durable. kkxqbh[.]top and ouewop[.]com are the highest-value network indicators because both vendor clusters converge on them.
• Both 1kkkkddd[.]com (digit one) and ikkkkddd[.]com (letter i) ship — this is not a typo. Seqrite documents them as two separately-registered look-alike domains: ikkkkddd.com appears as an in-memory C2 string, and 1kkkkddd.com is listed among the associated infrastructure domains. Correcting either one into the other would silently drop a live indicator, so both are carried verbatim. Anyone hand-transcribing this blocklist should double-check the first character.
• MixedRealityPortal.exe is not an indicator and is deliberately absent from the import CSV. It is the genuine Microsoft Mixed Reality Portal binary that ships under System32 — no cited source associates it with this campaign, and it is neither attacker-supplied nor the side-load host here (the side-load host is the signed COU_ITR-1_to_4_AY2026-27.exe). It appears in this pack only as a benign-baseline discriminator: it is the legitimate name that makes the campaign's Mixed Reality.exe in the Windows Media Player directory recognisably fake. Shipping it as a blockable atomic IOC would generate pure false positives against a stock Windows component. See Q1 and Q10.
• No MD5 or SHA1 values are published by any cited source. Rather than compute or infer them, the CSV ships a labelled REPLACE_WITH_ placeholder row.

Hunt hypotheses (ordered by fidelity)

Merged from the ATT&CK tables published by Cyderes and Seqrite. Coverage column reflects this pack's queries.

These cover the artifacts Falcon telemetry does not surface — extension-less lock files, named kernel objects, and the service registration itself. Run them on any host that hits a section-8 query. All are read-only.

1 · Root-level lock, kill and debug artifacts (hidden + system attributes)

Get-ChildItem -Path C:\ -Force -File |
  Where-Object { $_.Name -in @('kkooPPP','ouewo','kkqqexit','debug.txt') } |
  Select-Object Name, Length, CreationTime, LastWriteTime, Attributes

Any hit is high-confidence. kkooPPP means the Gh0st implant (6A) is or was resident; ouewo means the AsyncRAT loader (6B) is or was resident; kkqqexit is the injector's shutdown signal.

2 · The persistence service

Get-CimInstance Win32_Service |
  Where-Object { $_.Name -eq 'MixedSvc' -or $_.DisplayName -like '*Mixed Reality*' } |
  Select-Object Name, DisplayName, PathName, StartMode, State, Description

A PathName under C:\Program Files\Windows Media Player\ confirms compromise. Genuine Windows Mixed Reality does not register a service called MixedSvc.

3 · Staging directory contents

Get-ChildItem 'C:\Program Files\Windows Media Player\' -Force |
  Where-Object { $_.Name -in @('Mixed Reality.exe','nvdaHelperRemote.dll') } |
  Select-Object Name, Length, CreationTime, VersionInfo

Get-Item C:\Windows\background.jpg -Force -ErrorAction SilentlyContinue |
  Select-Object FullName, Length, CreationTime, LastWriteTime

A background.jpg substantially larger than a plain wallpaper JPEG is the polyglot container. Cyderes documented embedded payload regions at offsets 0x1587D, 0x52C04 and 0x165A04.

4 · Named kernel objects (live hosts only)

Get-ChildItem \\.\GLOBALROOT\BaseNamedObjects\ -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match 'kkctsbnn|ShitSetupOn26126k|5sGEm6Q4eTNv' } |
  Select-Object Name

These vanish on reboot, so a clean result on a rebooted host proves nothing. Present = active infection.

5 · Service-creation events in the System log

Get-WinEvent -FilterHashtable @{ LogName='System'; Id=7045 } -MaxEvents 400 |
  Where-Object { $_.Message -match 'MixedSvc|Mixed Reality|Windows Media Player' } |
  Select-Object TimeCreated, Id, Message

Event ID 7045 records service installation and is the most reliable timestamp for when stage 2 completed.

Three queries are strong enough to promote from hunt to Custom IOA. The rest stay Investigate-only.

Alert package — IOA-1 (from Q3)

Scheduled Search name: DETECT — PE Written to Windows Media Player Dir (Operation DragonReturn)

Description: Fires when any executable or DLL is written into C:\Program Files\Windows Media Player\. This is the staging directory used by the fake Indian ITR notice dual-RAT campaign; Windows Media Player is a frozen component with no legitimate writers.

Email subject: [CRITICAL] Detection: Operation DragonReturn — PE staged in Windows Media Player directory

Email body: A PE file was written into the Windows Media Player program directory on <ComputerName> by <ContextBaseFileName>. This directory is the documented staging path for a China-nexus-suspected campaign that side-loads a malicious DLL through a signed Indian tax utility and deploys two remote-access implants into svchost.exe across every logged-in session. Treat as an active intrusion until disproven. Isolate the host via Falcon RTR network containment before further triage — the campaign's stage 5 re-injects continuously and reaches every user session.

Triage checklist

1. Contain the host in Falcon (network containment) before any on-host action — both implants re-inject on a loop.
2. Record the writing process (ContextBaseFileName) and the written filename. Mixed Reality.exe or nvdaHelperRemote.dll confirms this campaign.
3. Run Q4 scoped to the host to confirm or exclude the MixedSvc service registration.
4. Run native hunt 1 (section 7) for c:\kkooPPP, c:\ouewo, c:\kkqqexit, c:\debug.txt — these tell you which implant(s) landed.
5. Check for C:\Windows\background.jpg and preserve it — it is the polyglot payload container and the single most useful forensic artifact.
6. Run Q8 and Q6 scoped to the host over full retention to establish whether C2 was reached and when.
7. Run Q9 to enumerate injected svchost.exe instances and identify which user sessions were reached.
8. Identify the delivery vector: Q5 for the ZIP write, then Q6 for the lure domain, then pull the browser history for the /incometax URL.
9. If C2 was reached, treat every credential used on the host — and every credential visible in a screen capture — as compromised.

Pivot queries

// Host-scoped: full campaign artifact sweep for one endpoint
#event_simpleName=/^(ProcessRollup2|PeFileWritten|NewExecutableWritten|DnsRequest|NetworkConnectIP4)$/
| ComputerName=/^REPLACE_WITH_HOSTNAME$/i
| TargetFileName=/Windows Media Player|nvdaHelperRemote|background\.jpg/i
  or ImageFileName=/Windows Media Player/i
  or DomainName=/kkxqbh\.top|ouewop\.com|ikkkkddd\.com/i
| table([ComputerName, UserName, FileName, ImageFileName, TargetFileName, DomainName, RemoteAddressIP4])

// Environment-wide: which sessions did stage 5 reach?
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^svchost(\.exe)?$/i
| ParentBaseFileName!=/^(services|svchost|MsMpEng)(\.exe)?$/i
| groupBy([ComputerName, UserName, UserSid], function=count(as=Instances), limit=500)

Run these before treating a zero-hit result as clean. A query that returns nothing because the telemetry is absent looks identical to a query that returns nothing because the environment is healthy.

The whole chain rests on two user-granted privileges: the ability to run a downloaded executable, and the ability to approve a UAC elevation. Remove either and the campaign stops at stage 2.

Playbook 1 — Harden UAC elevation behaviour (blocks stage 2)

Applies the CIS-recommended elevation prompt settings. Deploy via GPO or the registry values directly. Test on a pilot ring: help-desk workflows that rely on standard users self-elevating will change.

$p = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'

# Standard users must supply admin credentials on the secure desktop (3 = prompt for credentials)
Set-ItemProperty -Path $p -Name 'ConsentPromptBehaviorUser'  -Value 3 -Type DWord

# Administrators must consent on the secure desktop for every elevation (2 = prompt for consent)
Set-ItemProperty -Path $p -Name 'ConsentPromptBehaviorAdmin' -Value 2 -Type DWord

# Force the secure desktop and keep UAC fully enabled
Set-ItemProperty -Path $p -Name 'PromptOnSecureDesktop'      -Value 1 -Type DWord
Set-ItemProperty -Path $p -Name 'EnableLUA'                  -Value 1 -Type DWord

# Verify
Get-ItemProperty -Path $p |
  Select-Object ConsentPromptBehaviorUser, ConsentPromptBehaviorAdmin, PromptOnSecureDesktop, EnableLUA

GPO equivalent: Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options → "User Account Control: …". Verify with: gpresult /h uac.html.

Playbook 2 — Lock down the Windows Media Player staging directory

Removes write access for everyone except TrustedInstaller, directly blocking stage 2's staging step. Confirm no in-house media tooling writes to this path before deploying fleet-wide.

$dir = 'C:\Program Files\Windows Media Player'

# Report current writable principals first - review before changing anything
(Get-Acl $dir).Access |
  Where-Object { $_.FileSystemRights -match 'Write|Modify|FullControl' -and $_.AccessControlType -eq 'Allow' } |
  Select-Object IdentityReference, FileSystemRights, IsInherited

# Deny write for Users and Authenticated Users
icacls $dir /deny "BUILTIN\Users:(OI)(CI)(W)"
icacls $dir /deny "NT AUTHORITY\Authenticated Users:(OI)(CI)(W)"

# Verify the deny ACEs landed
icacls $dir

Roll back with icacls "C:\Program Files\Windows Media Player" /remove:d "BUILTIN\Users" "NT AUTHORITY\Authenticated Users" if a legitimate dependency surfaces.

Playbook 3 — Enable the relevant ASR rules (audit first)

Deploy in AuditMode for two weeks, mine the ASR event log, then flip to Enabled.

# Block executable content from email client and webmail
Add-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 `
                 -AttackSurfaceReductionRules_Actions AuditMode

# Block executable files unless they meet a prevalence, age, or trusted-list criterion
Add-MpPreference -AttackSurfaceReductionRules_Ids 01443614-cd74-433a-b99e-2ecdc07bfc25 `
                 -AttackSurfaceReductionRules_Actions AuditMode

# Review what would have been blocked
Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 500 |
  Where-Object { $_.Id -in 1121,1122 } |
  Select-Object TimeCreated, Id, Message

# Verify current configuration
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

Playbook 4 — Egress block for the dual-RAT C2 ports

Infrastructure-independent: survives every domain and IP rotation in this campaign.

New-NetFirewallRule -DisplayName 'Block outbound TCP 6666 (Gh0st RAT C2)' `
  -Direction Outbound -Action Block -Protocol TCP -RemotePort 6666 -Profile Any

New-NetFirewallRule -DisplayName 'Block outbound TCP 6351 (AsyncRAT C2)' `
  -Direction Outbound -Action Block -Protocol TCP -RemotePort 6351 -Profile Any

# Verify
Get-NetFirewallRule -DisplayName 'Block outbound TCP*' |
  Get-NetFirewallPortFilter | Select-Object Protocol, RemotePort

CQL spot-check after deployment — Q8 should return zero, and this should confirm the rule is doing the work rather than the malware being absent:

#event_simpleName=NetworkConnectIP4
| in(RemotePort, values=["6666", "6351"])
| groupBy([ComputerName, ContextBaseFileName, RemoteAddressIP4], function=count(as=Attempts), limit=200)

Playbook 5 — Persistence sweep for a suspect host

Read-only. Run via Falcon RTR on any host that hit Q3, Q4 or Q10 after network containment.

# 1. The persistence service
Get-CimInstance Win32_Service |
  Where-Object { $_.Name -eq 'MixedSvc' -or $_.PathName -like '*Windows Media Player*' } |
  Select-Object Name, DisplayName, PathName, StartMode, State

# 2. Staged binaries and the polyglot container
Get-ChildItem 'C:\Program Files\Windows Media Player\' -Force |
  Select-Object Name, Length, CreationTime
Get-Item C:\Windows\background.jpg -Force -ErrorAction SilentlyContinue |
  Select-Object FullName, Length, CreationTime

# 3. Root-level lock, kill and debug artifacts
Get-ChildItem -Path C:\ -Force -File |
  Where-Object { $_.Name -in @('kkooPPP','ouewo','kkqqexit','debug.txt') } |
  Select-Object Name, Length, CreationTime, Attributes

# 4. Service installation timestamp
Get-WinEvent -FilterHashtable @{ LogName='System'; Id=7045 } -MaxEvents 400 |
  Where-Object { $_.Message -match 'MixedSvc|Mixed Reality' } |
  Select-Object TimeCreated, Message

# 5. Injected svchost instances and the sessions they reached
Get-CimInstance Win32_Process -Filter "Name='svchost.exe'" |
  Select-Object ProcessId, ParentProcessId, SessionId, CommandLine

Reading the gaps: every gap sits in the in-memory half of the chain, which is exactly the design intent — the operator traded on-disk footprint away deliberately. The compensating control is that stage 2 must touch disk and the registry to persist, and both implants must reach the network. Q3, Q4, Q10 and Q8 bracket the in-memory stages on either side; a chain that evades all four is not this campaign.

Provenance: the verbatim fetched text of all eight sources is saved alongside this pack in OperationDragonReturn-Hunt-sources/. Every atomic indicator in section 10 was verified to appear in that saved text by check_ioc_provenance.py before this pack was released.

Attribution caveat, restated: "China-nexus" and the Silver Fox overlap are an analytic assessment published by Seqrite at medium-to-high confidence, not a confirmed attribution. Anyone re-using this pack's language in customer or executive reporting should carry the caveat with it.