PAPERMILL — VenomRAT v6.0.3 via ISO/.img & Renamed Signed Notepad++

China-nexus commodity-crimeware cluster, Silver Fox-like tradecraft (not attributed to Silver Fox) · tax-audit lures targeting Indian recipients · reported by JUMPSEC DART, 2026-09-15

Threat

PAPERMILL / VenomRAT v6.0.3

Severity

HIGH

Type

Commodity RAT loader chain

Access

Phishing → ISO/.img → DLL sideload

Version

v0.2 (Draft) — 2026-09-22

Author

HuntPack

Confidence

Single-source (see §1/§2)

Executive Summary

PAPERMILL is an emerging malware cluster reported by JUMPSEC's Detection and Response Team (DART) on 2026-09-15. The attacker's objective is straightforward remote-access commodity crimeware: get VenomRAT v6.0.3 running on an Indian tax-payer's workstation to enable hidden-desktop (HVNC) control, keystroke logging, browser-credential theft, and cryptocurrency-wallet draining. The lure is a tax-audit-themed phishing email carrying an ISO 9660 disk image with a .img extension, built with PyCdlib. Because files inside a mounted disk image do not inherit the Mark-of-the-Web, the payload chain — a legitimately signed Notepad++ binary renamed to look like a tax notice, sideloading a malicious libcurl.dll that proxies only the four real curl_* exports Notepad++ needs — walks straight past SmartScreen and download-reputation checks that would normally fire on a browser-downloaded archive.

The highest-value defensive angle is not the atomic indicators (hashes and a handful of infrastructure values rotate quickly and are dynamically generated per victim per JUMPSEC's own reporting) — it is the three durable behavioral anomalies the campaign cannot easily change without rebuilding its whole toolchain: (1) a child process launched from a mounted, non-system-drive image volume; (2) a legitimately-signed executable whose on-disk FileName does not match its expected identity, sitting next to an anomalously-located libcurl.dll; and (3) a persistence artifact (RuntimeBroker.exe) running from %APPDATA% instead of its legitimate System32 home. §8 builds hunts around all three.

Defender priority: this pack is built from a single independent primary source (JUMPSEC DART; every other cited outlet is derivative coverage of that one report — see §2). Every atomic indicator in this pack therefore ships as action=detect, never prevent, and no severity is marked critical. Treat the behavioral hunts in §8 (mounted-image execution, signed-binary/DLL-sideload mismatch, RuntimeBroker path anomaly) as the primary, durable coverage; treat the IOC table as a perishable pivot list, not a blocklist.

Source Review & Web Hunter Notes

Sourcing constraint (read before using this pack): JUMPSEC's guide is the only independent primary source for PAPERMILL identified during research. GBHackers, Cybersecurity News, Security Online, and CyberPress are all derivative summaries of the same JUMPSEC report — none contributed independent technical corroboration (no second detonation, no independent sample analysis, no separate telemetry). This is functionally single-source reporting wearing four bylines. JUMPSEC itself states moderate-to-high confidence in the China-nexus attribution and explicitly declines to attribute the cluster to Silver Fox — their own framing is "a Silver Fox family fingerprint, but the specific implementation is a variant, not a repetition." This pack preserves that caveat everywhere it matters: the IOC CSV (§10), the coverage map (§15), and the hunt ticket (§16).

Tier	Source	Key Finding	Carry Forward
PRIMARY	JUMPSEC DART — "An Emerging Silver Fox-Like Cluster: PAPERMILL"	Full infection chain, attribution confidence table, and the report's narrative IOC summary (hashes, C2, cert thumbprint)	yes
PRIMARY	Same URL as above — full Indicators-of-Compromise appendix	The report's complete IOC, sibling-sample, and sister-infrastructure tables: internal DLL naming pattern, staging temp filenames, master key/PBKDF2 salt, both certificate thumbprints, seven sibling-sample hashes with VT labels, and the July-2026 sister-infrastructure and DGA domain cluster	yes
SECONDARY	GBHackers	Restates infection chain and Silver Fox-adjacency framing; no new IOCs	partial
SECONDARY	Cybersecurity News	Confirms 3 of 4 primary hashes and RunOnce persistence key; defensive recommendations	partial
SECONDARY	Security Online	Most detailed derivative write-up; confirms cipher chain, dynamic-hash-per-victim detail, attribution quote	partial
SECONDARY	CyberPress	Confirms sender/IP delivery indicators and Donut framework identification	partial

How confidence is scaled in this pack: the JUMPSEC report itself distinguishes between indicators tied directly to the September 2026 PAPERMILL chain (the ISO/launcher/DLL/payload hashes, the C2, the core delivery infrastructure) and indicators it surfaces by pivoting on the builder certificate and C2 into earlier, related campaign waves from July 2026 (the sibling samples and sister delivery infrastructure below). §4 and §10 carry that distinction forward as a confidence gradient: high for the core September chain, medium for directly-named pivots (sibling hashes, a secondary C2 address), and low for the July-2026 sister-infrastructure and DGA domains, which are one step further removed from the confirmed chain. Every value at every tier is still drawn from the cited report and every row ships action=detect — the tiering reflects how central each value is to the confirmed chain, not whether it is sourced.

A small number of details in the cited report add color but are not shipped as formal indicators in §4/§10: a related phishing certificate referenced only by its own domain (ekl1-neettr[.]bond) sits outside the PAPERMILL delivery chain proper and is left as a lead for further pivoting rather than a scored indicator; a tracking-beacon URL path is recorded against a loopback placeholder host in the report itself and has no resolvable network value to ship. Both are described in §7/§10 where they are useful without being scored as atomic IOCs.

No prompt-injection or instruction-like content directed at an AI assistant was found in any of the fetched sources during research, including the fuller IOC-table capture of the JUMPSEC report used for this revision.

Hunt Brief & Attack Chain

Hunt hypotheses (ordered by fidelity)

H1 — High: A signed executable whose FileName does not match a known-good identity loads a co-located libcurl.dll from a non-standard directory. This is the campaign's core defense-evasion trick and is hard to change without rebuilding the whole sideload chain.
H2 — High: RuntimeBroker.exe — a legitimate Windows filename — executes from %APPDATA%\Microsoft\Crypto\RuntimeBroker\ instead of %SystemRoot%\System32\. Path, not name, is the anomaly.
H3 — Medium: A process is launched with its ImageFileName rooted on a non-system drive letter with no surrounding directory structure, parented by explorer.exe — consistent with double-clicking an executable inside a freshly-mounted ISO/.img.
H4 — Medium: libcurl.dll — a legitimate library name shipped by many dev tools — loads from a path outside the small set of known-good vendor install directories. The loader's own internal module name, libcurl.dll_<digits>.dll (the digits vary per build), is a more durable variant of this same signal and is folded into Q2/Q3.
H5 — Medium: An HKCU...\RunOnce registry value is written by a process executing from a user-writable %APPDATA% path rather than a signed installer under Program Files.
H6 — Medium: cvtres.exe — a legitimate Visual C++ resource-compiler helper — runs with a parent process outside the normal MSVC/MSBuild toolchain. JUMPSEC's IOC appendix confirms VenomRAT's HVNC worker kills any running cvtres.exe process on reconnect, which is the behavior this hunt targets.
H7 — High: Outbound network connection to the reported C2 endpoint 154.36.188.201:4449.
H8 — High: DNS resolution to the campaign's reported delivery infrastructure domains.

Attack chain

#	Step	Telemetry	Hunt Angle
1	Phishing email, tax-audit lure subject, ISO 9660 `.img` attachment (PyCdlib-built)	Email gateway / MTA logs	§7 native mail-gateway hunt
2	User double-clicks/mounts image; contents bypass Mark-of-the-Web	Explorer shell events, volume-mount events	§7 native MOTW/Zone.Identifier check; §8 Q1 (H3)
3	`Tax_Notice_45594.exe` — a legitimately signed, renamed Notepad++ binary — executes	`ProcessRollup2`, Authenticode fields	§8 Q1, Q3 (H1, H3)
4	Notepad++ sideloads malicious `libcurl.dll` from the same directory	`ImageHash` event	§8 Q2, Q3 (H1, H4)
5	`libcurl.dll` proxies real `curl_*` exports while running loader code; internally named `libcurl.dll_<digits>.dll`	Module-load telemetry (`ImageHash`)	§8 Q2, Q3 (H1, H4)
6	Loader decrypts `LIBCURL.DAT` via XOR + bitwise NOT + Fisher-Yates shuffle + RC4; uses `_dbg_src.tmp`/`_dbg_dst.tmp` staging temp files during the process	File-read + high-entropy-write telemetry; temp-file creation (Sysmon)	§7 native temp-staging hunt; cipher-chain step itself is a coverage gap — see §15
7	Decrypted blob is Donut 0.9.2 position-independent shellcode	In-memory execution (no direct Falcon field)	Coverage gap — see §15
8	Donut reflectively loads an encrypted .NET DLL in memory	Reflective-load behavioral telemetry	Coverage gap — see §15
9	VenomRAT v6.0.3 runs reflectively (`stage2.dll`); mutex `xkoqvgcojtqgi`, campaign group "Default"	Process/hash telemetry once resident	§10 IOC appendix (hash pivot)
10	Persistence: `RuntimeBroker.exe` dropped to `%APPDATA%\Microsoft\Crypto\RuntimeBroker\`; `HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce`	`PeFileWritten`/`NewExecutableWritten`, `AsepValueUpdate`	§8 Q4, Q5 (H2, H5)
11	C2 to `154.36.188.201:4449`	`NetworkConnectIP4`	§8 Q7 (H7)

Consolidated IOC Table

Confidence reflects how directly each value sits in the cited primary report: high for the confirmed September 2026 PAPERMILL delivery chain, medium for directly-named pivots the report draws from that chain (a secondary C2 address, sibling-sample hashes sharing the same builder certificate), and low for infrastructure the report ties to earlier, related July 2026 campaign waves rather than the confirmed chain itself (see §2). Action reflects how a detection platform should treat the value: detect = alert/log; hunt = run as a search and review manually; pivot = investigative lead only, not natively importable. Every row below is detect, none is marked critical severity, and this table is in exact row-for-row agreement with the CSV in §10.

Type	Value	Confidence	Action	Context	Expiry
sha256	f945b3f2f29d62099683cbbf069ed5bc952d089c16a85fb314ac8fe0f0c10d2b	high	detect	ISO 9660 lure container (Tax_Notice_45594.img)	2027-03-22
sha256	fe0ddd8686324e0a8b07ed5ffdb4f56397c70b1b5a19d2916c8eb192583f950c	high	detect	Renamed signed Notepad++ launcher (Tax_Notice_45594.exe)	2027-03-22
sha256	8c1ba078598e09294d72293a42dcd878e183b6e5a207315f7bf6ef74a966cbb5	high	detect	Malicious libcurl.dll sideload loader	2027-03-22
sha256	947221d0f1e2c9c09028491997406dd9f0cb5b65258556c86d201ec1ca538f5f	high	detect	VenomRAT v6.0.3 reflective payload (stage2.dll)	2027-03-22
sha256	2ff898c1a4bb0dd48687bbbc8cca646a896dc9ed24780a49523dfbf9fb94a4ec	high	detect	LIBCURL.DAT encrypted Donut-stage payload	2027-03-22
ipv4	154.36.188.201	high	detect	PAPERMILL VenomRAT C2 (tcp/4449)	2027-03-22
ipv4	155.94.154.195	medium	detect	Phishing sending IP	2027-03-22
ipv4	103.23.172.15	medium	detect	Resolution target of the .xin/.ink DGA-pattern domain cluster below	2027-03-22
domain	hsaui.cc	medium	detect	Phishing sender domain (dfgfasd@hsaui[.]cc)	2027-03-22
domain	mos1.17dlz.cn	medium	detect	Sending MTA HELO/PTR	2027-03-22
domain	dsfgssd.uk.cc	medium	detect	Payload landing domain (/download.php)	2027-03-22
domain	dgdskfds.uk.cc	medium	detect	Related delivery infrastructure named in the core report (Cloudflare-fronted)	2027-03-22
ipv4	103.119.15.189	medium	detect	Secondary C2 tied to a sibling sample on the same builder certificate (AS140869, Turing Group)	2026-12-22
sha256	72a321802d738e8bc6a0ab9d9d24b380be944fffbfc85094b889690b679a73c2	medium	detect	Sibling sample: ClientAny.exe / skkr3.exe; VT trojan.asyncrat/msil; same builder cert	2027-03-22
sha256	268a90d07cf02b16c091ef6cc52e3dbe17638bb722221807bc833c4c1299a8a9	medium	detect	Sibling sample: Tax_Notice_16695 (1).img; VT trojan.shellcode/dllhijack; same builder cert	2027-03-22
sha256	f23708ae470904490cb25d370185ca89c0d37e33fa5a3c652e4b10e65d0b08e3	medium	detect	Sibling sample: ITDENF2026-4281.img; VT trojan.dllhijack/shellcode; same builder cert	2027-03-22
sha256	d768222934f6014bf17c3d0a1ef4c35e02aa6fe1e89564e252ca5e7b7c7fe237	medium	detect	Sibling sample: Tax_436454367.img; VT trojan.dllhijack/shellcode; same builder cert	2027-03-22
sha256	0c0e4935f8df04e86056798d417bf3f485c640fa0322756c0a860af2a6bd0f1d	medium	detect	Sibling sample: 2023-dated Chinese-language payment-notice lure; VT trojan.msil/dinvoke; same builder cert	2027-03-22
sha256	38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c	high	detect	Sibling sample: Tax_Notice_23665.img (2026-07-15); VT trojan.shellcode/misc; JUMPSEC observed this sample contacting the SAME C2 as the core September chain — the strongest pivot in the sibling set	2027-03-22
sha256	a4098fe9ed421a6244c9fd4d3d1a632ff5f2ee4ffa204dff0587548932936d38	high	detect	Sibling sample: Tax_Notice_99674.img (2026-07-23); VT trojan.misc/donut; JUMPSEC observed this sample contacting the SAME C2 as the core September chain — the strongest pivot in the sibling set	2027-03-22
domain	aidenllc.com	low	detect	Sister delivery host, July 2026 waves (AWS ap-south-1)	2026-12-22
domain	gov-xnui.com	low	detect	Sister delivery host, July 2026 waves	2026-12-22
domain	xjxfxn.com	low	detect	Sister delivery host, July 2026 waves (Tencent HK)	2026-12-22
domain	jfbcea.com	low	detect	Sister delivery host, July 2026 waves (BGPNET SC)	2026-12-22
domain	tzawccsw.xin	low	detect	DGA-pattern cluster member, resolves to 103.23.172.15	2026-12-22
domain	zxizusuy.xin	low	detect	DGA-pattern cluster member, resolves to 103.23.172.15	2026-12-22
domain	zasudtytw.xin	low	detect	DGA-pattern cluster member, resolves to 103.23.172.15	2026-12-22
domain	zixhasda.xin	low	detect	DGA-pattern cluster member, resolves to 103.23.172.15	2026-12-22
domain	pzisiauywa.xin	low	detect	DGA-pattern cluster member, resolves to 103.23.172.15	2026-12-22
domain	gisudyawz.ink	low	detect	DGA-pattern cluster member, resolves to 103.23.172.15	2026-12-22
mutex	xkoqvgcojtqgi	medium	hunt	VenomRAT runtime mutex — memory-resident pivot, not natively Falcon-importable	2026-12-22
context	Cert thumbprints SHA1 009a05eaf082d20ae13a65abda12afd959cd76de / SHA256 f72bf7c1fd132262715820d839e4874c97d927b10072fb4709a1321927fea66d; CN=VenomRAT, C=CN, L=SH, O=VenomRAT By qwqdanchun, OU=qwqdanchun, CN=LMTEAM Server	medium	pivot	Builder code-signing certificate — not a Falcon-native IOC type; useful for cert-pivot hunting across the sibling-sample set	2026-10-22

Affected Surface & Telemetry Matrix

Surface	Required Telemetry	Priority	Gap Risk
Windows endpoint — process execution	ProcessRollup2 / SyntheticProcessRollup2	High	Low — standard Falcon sensor coverage
Windows endpoint — module/DLL load	ImageHash	High	Medium — module-load telemetry volume can be tuned down in some tenants
Windows endpoint — file write	PeFileWritten / NewExecutableWritten	Medium	Low
Windows endpoint — registry	AsepValueUpdate / RegGenericValueUpdate	High	Low
Network — outbound connections	NetworkConnectIP4	High	Low
Network — DNS	DnsRequest	Medium	Low
Email gateway	MTA/SEG logs (non-Falcon)	High	High — outside Falcon telemetry scope; see §7
In-memory shellcode / reflective .NET load (Donut stage)	No direct Falcon field for this specific technique	High	High — behavioral-only coverage gap, flagged in §15

ATT&CK Mapping

Tactic	Technique	Name	Observed Behavior
Initial Access	T1566.001	Phishing: Spearphishing Attachment	Tax-audit lure email delivers ISO 9660 `.img` attachment
Defense Evasion	T1553.005	Subvert Trust Controls: Mark-of-the-Web Bypass	PyCdlib-built container; mounted contents do not inherit MOTW
Defense Evasion	T1036.005	Masquerading: Match Legitimate Name or Location	Signed Notepad++ binary renamed to Tax_Notice_45594.exe
Defense Evasion / Persistence	T1574.002	Hijack Execution Flow: DLL Side-Loading	Malicious libcurl.dll proxies real curl_easy_setopt/cleanup/init/perform exports
Defense Evasion	T1027	Obfuscated Files or Information	XOR + NOT + Fisher-Yates shuffle + RC4 cipher chain decrypts LIBCURL.DAT; misleading .nvdata/.nvtext/.pdata section names
Defense Evasion	T1497	Virtualization/Sandbox Evasion	CPU/RAM/disk/uptime/cursor checks; 5-minute sleep to outlast automated analysis
Defense Evasion / Execution	T1620	Reflective Code Loading	Donut 0.9.2 shellcode reflectively loads encrypted .NET VenomRAT DLL
Persistence	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / RunOnce	RuntimeBroker.exe dropped; HKCU...RunOnce entry added
Command and Control	T1071.001	Application Layer Protocol: Web Protocols	C2 to 154.36.188.201:4449
Collection / Access	T1219	Remote Access Software	VenomRAT HVNC hidden-desktop control, keystroke logging, browser/wallet theft
Command and Control / Delivery	T1105	Ingress Tool Transfer	Payload retrieval via dsfgssd[.]uk[.]cc/download.php

Native Audit-Log Hunts

Email gateway / MTA

Filter for inbound mail with an .iso or .img attachment (including inside a .zip) combined with a subject line matching the Devanagari tax-audit lure pattern (कर लेखापरीक्षा परिणाम) or the ASCII reference pattern ITD/SCNU/2026-. Cross-reference envelope sender domain against hsaui.cc and HELO/PTR against mos1.17dlz.cn (§4/§10). Most secure email gateways expose this as a content-disposition + regex rule; exact syntax is vendor-specific (Proofpoint, Mimecast, Defender for Office 365 mail flow rules, etc.) and is out of CQL scope for this pack.

Mark-of-the-Web / Zone.Identifier verification

On a suspect host, confirm the absence of a Zone.Identifier alternate data stream on the executed binary — the mechanical signature of MOTW bypass via mounted image:

Get-Item -Path 'C:\Users\<user>\Desktop\Tax_Notice_*.exe' -Stream Zone.Identifier -ErrorAction SilentlyContinue
# No output / "PropertyNotFoundException" == no MOTW was ever applied == consistent with mounted-image execution

Volume-mount event review

Review Microsoft-Windows-VHDMP-Operational and Microsoft-Windows-DeviceSetupManager/Admin Windows Event Logs for a new optical/virtual-CD-ROM device arrival immediately preceding process execution from a non-system drive letter — this corroborates §8 Q1 without relying on Falcon telemetry alone.

CrowdStrike LogScale CQL Hunt Queries

Falcon cloud (drives "Open in Falcon"): Pick your tenant's cloud first — every "Open in Falcon" button below uses this selection.

Q1 · Process execution from a mounted ISO/.img volume (H3)

CONF MEDIUMFP MEDIUMCOST LOW

Looks for: a process launched directly from the root of a non-system drive letter (consistent with a freshly-mounted ISO/.img), parented by Explorer. FP: legitimate portable apps run from USB drives or IT-approved imaging tools will also match — see TUNING.

// HUNT: Process execution from a mounted ISO/.img volume
// MITRE: T1566.001, T1553.005
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (default 7d search window via the Falcon time picker, not an in-query filter)
// FALSE POSITIVES: portable apps launched from IT-approved USB media; legitimate optical-media software installers
// TUNING: exclude known imaging/deployment tool paths and first-seen-elsewhere-on-fleet executables; scope to hosts with no active IT ticket for physical/virtual media use
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^explorer\.exe$/i
| ImageFileName=/^[D-Zd-z]:\\[^\\]+\.exe$/i
| ImageFileName!=/^[Cc]:\\/
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine, SHA256HashData])

Q2 · libcurl.dll loaded from a non-standard directory (H4)

CONF HIGHFP MEDIUMCOST MEDIUM

Looks for: libcurl.dll — a legitimate filename shipped by many dev tools — loading from a path outside the small set of known-good vendor install directories. Also matches the loader's own internal module name, libcurl.dll_<digits>.dll (JUMPSEC observed libcurl.dll_38768.dll; the digit suffix is per-build), which is a more durable variant of the same signal since it survives a rename of the on-disk filename. FP: Git for Windows, CMake, PostgreSQL and similar dev tools legitimately ship their own libcurl.dll — see TUNING.

// HUNT: libcurl.dll (or its internal libcurl.dll_<digits>.dll name) module load from a non-standard directory
// MITRE: T1574.002
// CONF: high  FP: medium  COST: medium
// REQUIRES: ImageHash
// FALSE POSITIVES: Git for Windows (Program Files\Git\...), CMake, PostgreSQL, curl's own official installer -- all ship a legitimate libcurl.dll
// TUNING: exclude FilePath prefixes under Program Files\Git\, Program Files\CMake\, Program Files\PostgreSQL\, and other approved dev-tool install roots
#event_simpleName=ImageHash
| rename(field=[[FileName, Dll_Loaded], [FilePath, Dll_Path]])
| Dll_Loaded=/^libcurl\.dll(_\d+\.dll)?$/i
| Dll_Path!=/\\Windows\\(System32|SysWOW64)\\/i
| Dll_Path!=/\\Program Files\\Git\\/i
| Dll_Path!=/\\Program Files\\CMake\\/i
| Dll_Path!=/\\Program Files\\PostgreSQL\\/i
| table([@timestamp, aid, ComputerName, TargetProcessId, Dll_Loaded, Dll_Path])

Q3 · Signed non-Notepad++ image co-loading libcurl.dll (H1 — core sideload hunt)

CONF HIGHFP MEDIUMCOST MEDIUM

Looks for: a signed executable (AuthenticodeHashData present) whose FileName is NOT notepad++.exe, correlated to the same process loading libcurl.dll. This is the direct behavioral signature of the campaign's renamed-binary + sideload trick, independent of any specific hash. FP: a small number of legitimate signed installers legitimately pair with a differently-named libcurl.dll — see TUNING.

// HUNT: Signed executable, not Notepad++, co-loading libcurl.dll from its own directory
// MITRE: T1036.005, T1574.002
// CONF: high  FP: medium  COST: medium
// REQUIRES: ProcessRollup2, ImageHash
// FALSE POSITIVES: rare legitimate installers that ship both a signed EXE and a same-directory libcurl.dll under a non-"notepad++" name
// TUNING: allowlist by AuthenticodeHashData for verified-legitimate signed publishers found during initial tuning; exclude known software-deployment tool directories
#event_simpleName=/ProcessRollup2|ImageHash/
| falconPID := TargetProcessId
| rename(field=[[FileName, Dll_Loaded]])
| selfJoinFilter(field=[aid, falconPID], where=[
    {#event_simpleName=ProcessRollup2; AuthenticodeHashData=*; FileName!=/^notepad\+\+\.exe$/i},
    {#event_simpleName=ImageHash; Dll_Loaded=/^libcurl\.dll(_\d+\.dll)?$/i}
])
| table([@timestamp, aid, ComputerName, FileName, ImageFileName, AuthenticodeHashData, Dll_Loaded])

Q4 · RuntimeBroker.exe executing outside System32 (H2)

CONF HIGHFP LOWCOST LOW

Looks for: a process named RuntimeBroker.exe — legitimate on every Windows host under System32 — running from anywhere else. FP: very low; RuntimeBroker.exe has no legitimate reason to run outside System32.

// HUNT: RuntimeBroker.exe running from a non-System32 path
// MITRE: T1036.005, T1547.001
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: none observed; flag any hit for immediate triage
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^RuntimeBroker\.exe$/i
| ImageFileName!=/\\Windows\\System32\\/i
| ImageFileName!=/\\Windows\\SysWOW64\\/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine, SHA256HashData])

Q5 · RunOnce persistence written from an %APPDATA% process (H5)

CONF MEDIUMFP HIGHCOST LOW

Looks for: a RunOnce autostart key written by a process executing from a user-writable AppData path rather than a signed Program Files installer. FP: high — many legitimate updater agents (browser, chat-app, cloud-sync updaters) do exactly this — see TUNING.

// HUNT: HKCU RunOnce write by a process executing from %APPDATA%
// MITRE: T1547.001
// CONF: medium  FP: high  COST: low
// REQUIRES: AsepValueUpdate / RegGenericValueUpdate
// FALSE POSITIVES: legitimate AppData-resident updater agents (browser updaters, Zoom/Slack/Teams/Dropbox update tasks) routinely write RunOnce/Run keys
// TUNING: allowlist by ImageFileName or SHA256HashData for approved updater binaries; prioritize hits where the writing process also appears in Q1-Q4
#event_simpleName=/AsepValueUpdate|RegGenericValueUpdate/
| RegObjectName=/\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce/i
| ImageFileName=/\\AppData\\(Roaming|Local)\\/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, RegObjectName, RegValueName, RegStringValue])

Q6 · cvtres.exe with an unexpected parent process (H6)

CONF MEDIUMFP HIGHCOST LOW

Looks for: cvtres.exe — a legitimate Visual C++ resource-compiler helper — with a parent outside the normal MSVC/MSBuild toolchain. JUMPSEC's IOC appendix confirms the VenomRAT HVNC worker kills any running cvtres.exe process on reconnect, so an unexpected parent chain here is consistent with reported campaign behavior, not just a name coincidence. FP: very high on any developer workstation — see TUNING.

// HUNT: cvtres.exe with a parent outside the MSVC/MSBuild toolchain
// MITRE: T1036.005, T1219
// CONF: medium  FP: high  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: extremely common on developer workstations where cvtres.exe is legitimately spawned by cl.exe, link.exe, msbuild.exe, devenv.exe, dumpbin.exe, rc.exe, vctip.exe
// TUNING: scope to hosts WITHOUT Visual Studio / Build Tools / Windows SDK installed for highest fidelity; on dev hosts, require correlation with Q3/Q4 hits before triage
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^cvtres\.exe$/i
| ParentBaseFileName!=/^(cl|link|msbuild|devenv|dumpbin|rc|vctip)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine])

Q7 · Network connection to reported PAPERMILL C2 (H7)

CONF HIGHFP LOWCOST LOW

Looks for: outbound connection to the reported C2 IP/port. FP: low — this specific IP:port pair has no known benign use.

// HUNT: Outbound connection to reported PAPERMILL C2
// MITRE: T1071.001
// CONF: high  FP: low  COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: none observed
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4=154.36.188.201
| RemotePort=4449
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort])

Q8 · DNS resolution to reported delivery infrastructure (H8)

CONF HIGHFP MEDIUMCOST LOW

Looks for: DNS queries to the reported delivery/landing domains. FP: medium — passive-DNS or threat-intel enrichment platforms querying known-bad domains for research purposes can also trigger this. Single-source caveat applies (§2) — treat as detect/hunt only.

// HUNT: DNS resolution to reported PAPERMILL delivery infrastructure
// MITRE: T1071.001, T1105
// CONF: high  FP: medium  COST: low
// REQUIRES: DnsRequest
// FALSE POSITIVES: threat-intel/passive-DNS enrichment tooling resolving known-bad domains for research
// TUNING: exclude known TI-platform and sandbox-detonation egress hosts from ComputerName/aid
#event_simpleName=DnsRequest
| DomainName=/^(hsaui\.cc|mos1\.17dlz\.cn|dsfgssd\.uk\.cc|dgdskfds\.uk\.cc)$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName])

CrowdStrike Custom IOA Recommendations

Given the single-source constraint (§2), recommended IOA deployment mode is monitor/alert only — do not deploy in blocking/kill mode until independent corroboration exists.

IOA Name	Pattern (from)	Exclusions	Deployment Path
Signed-Binary Sideload Mismatch (Notepad++/libcurl)	Q3	Approved software-deployment directories; allowlisted AuthenticodeHashData values collected during pilot	Falcon Custom IOA rule group → Windows → pilot on a small host ring in Monitor mode for 2 weeks → review false-positive rate → promote to Detect (org-wide alert)
RuntimeBroker.exe Path Anomaly	Q4	None expected; low false-positive baseline	Falcon Custom IOA rule group → Windows → Detect (org-wide) from day one — false-positive risk is negligible

Q1, Q2, Q5, Q6, Q7, Q8 remain Investigate-only hunt queries pending a lower false-positive rate after tuning (Q1/Q2/Q5/Q6) or pending corroboration of infrastructure beyond a single primary source (Q7/Q8).

Machine-Readable IOC Appendix

Grouped, one-click blocks below. Every atomic value in the Falcon CSV block has been mechanically traced against the six saved source snapshots (PAPERMILL-VenomRAT-Notepad-Hunt-sources/); every row ships action=detect per the single-source constraint in §2, and this CSV is in exact row-for-row agreement with the IOC table in §4.

Falcon IOC Management CSVbulk import — all rows action=detect

type,value,action,severity,expiration,description,tags
sha256,f945b3f2f29d62099683cbbf069ed5bc952d089c16a85fb314ac8fe0f0c10d2b,detect,high,2027-03-22,PAPERMILL ISO9660 lure container (Tax_Notice_45594.img),campaign:PAPERMILL
sha256,fe0ddd8686324e0a8b07ed5ffdb4f56397c70b1b5a19d2916c8eb192583f950c,detect,high,2027-03-22,PAPERMILL renamed signed Notepad++ launcher,campaign:PAPERMILL
sha256,8c1ba078598e09294d72293a42dcd878e183b6e5a207315f7bf6ef74a966cbb5,detect,high,2027-03-22,PAPERMILL malicious libcurl.dll sideload loader,campaign:PAPERMILL
sha256,947221d0f1e2c9c09028491997406dd9f0cb5b65258556c86d201ec1ca538f5f,detect,high,2027-03-22,PAPERMILL VenomRAT v6.0.3 reflective payload (stage2.dll),campaign:PAPERMILL
sha256,2ff898c1a4bb0dd48687bbbc8cca646a896dc9ed24780a49523dfbf9fb94a4ec,detect,high,2027-03-22,PAPERMILL LIBCURL.DAT encrypted Donut-stage payload,campaign:PAPERMILL
ipv4,154.36.188.201,detect,high,2027-03-22,PAPERMILL VenomRAT C2 (tcp/4449),campaign:PAPERMILL
ipv4,155.94.154.195,detect,medium,2027-03-22,PAPERMILL phishing sending IP,campaign:PAPERMILL
ipv4,103.23.172.15,detect,medium,2027-03-22,PAPERMILL-adjacent DGA resolution target,campaign:PAPERMILL
domain,hsaui.cc,detect,medium,2027-03-22,PAPERMILL phishing sender domain,campaign:PAPERMILL
domain,mos1.17dlz.cn,detect,medium,2027-03-22,PAPERMILL sending MTA HELO/PTR,campaign:PAPERMILL
domain,dsfgssd.uk.cc,detect,medium,2027-03-22,PAPERMILL payload landing domain,campaign:PAPERMILL
domain,dgdskfds.uk.cc,detect,medium,2027-03-22,PAPERMILL related delivery infrastructure named in the core report,campaign:PAPERMILL
ipv4,103.119.15.189,detect,medium,2026-12-22,PAPERMILL secondary C2 tied to a sibling sample on the same builder cert (AS140869 Turing Group),campaign:PAPERMILL;tier:sibling
sha256,72a321802d738e8bc6a0ab9d9d24b380be944fffbfc85094b889690b679a73c2,detect,medium,2027-03-22,PAPERMILL sibling sample ClientAny.exe / skkr3.exe -- VT trojan.asyncrat/msil -- same builder cert,campaign:PAPERMILL;tier:sibling
sha256,268a90d07cf02b16c091ef6cc52e3dbe17638bb722221807bc833c4c1299a8a9,detect,medium,2027-03-22,PAPERMILL sibling sample Tax_Notice_16695 (1).img -- VT trojan.shellcode/dllhijack -- same builder cert,campaign:PAPERMILL;tier:sibling
sha256,f23708ae470904490cb25d370185ca89c0d37e33fa5a3c652e4b10e65d0b08e3,detect,medium,2027-03-22,PAPERMILL sibling sample ITDENF2026-4281.img -- VT trojan.dllhijack/shellcode -- same builder cert,campaign:PAPERMILL;tier:sibling
sha256,d768222934f6014bf17c3d0a1ef4c35e02aa6fe1e89564e252ca5e7b7c7fe237,detect,medium,2027-03-22,PAPERMILL sibling sample Tax_436454367.img -- VT trojan.dllhijack/shellcode -- same builder cert,campaign:PAPERMILL;tier:sibling
sha256,0c0e4935f8df04e86056798d417bf3f485c640fa0322756c0a860af2a6bd0f1d,detect,medium,2027-03-22,PAPERMILL sibling sample 2023-dated Chinese-language payment-notice lure -- VT trojan.msil/dinvoke -- same builder cert,campaign:PAPERMILL;tier:sibling
sha256,38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c,detect,high,2027-03-22,PAPERMILL sibling sample Tax_Notice_23665.img (2026-07-15) -- VT trojan.shellcode/misc -- contacts the SAME C2 as the core chain,campaign:PAPERMILL;tier:sibling
sha256,a4098fe9ed421a6244c9fd4d3d1a632ff5f2ee4ffa204dff0587548932936d38,detect,high,2027-03-22,PAPERMILL sibling sample Tax_Notice_99674.img (2026-07-23) -- VT trojan.misc/donut -- contacts the SAME C2 as the core chain,campaign:PAPERMILL;tier:sibling
domain,aidenllc.com,detect,low,2026-12-22,PAPERMILL sister delivery host July 2026 waves (AWS ap-south-1),campaign:PAPERMILL;tier:sister-infra
domain,gov-xnui.com,detect,low,2026-12-22,PAPERMILL sister delivery host July 2026 waves,campaign:PAPERMILL;tier:sister-infra
domain,xjxfxn.com,detect,low,2026-12-22,PAPERMILL sister delivery host July 2026 waves (Tencent HK),campaign:PAPERMILL;tier:sister-infra
domain,jfbcea.com,detect,low,2026-12-22,PAPERMILL sister delivery host July 2026 waves (BGPNET SC),campaign:PAPERMILL;tier:sister-infra
domain,tzawccsw.xin,detect,low,2026-12-22,PAPERMILL DGA-pattern cluster member resolves to 103.23.172.15,campaign:PAPERMILL;tier:dga
domain,zxizusuy.xin,detect,low,2026-12-22,PAPERMILL DGA-pattern cluster member resolves to 103.23.172.15,campaign:PAPERMILL;tier:dga
domain,zasudtytw.xin,detect,low,2026-12-22,PAPERMILL DGA-pattern cluster member resolves to 103.23.172.15,campaign:PAPERMILL;tier:dga
domain,zixhasda.xin,detect,low,2026-12-22,PAPERMILL DGA-pattern cluster member resolves to 103.23.172.15,campaign:PAPERMILL;tier:dga
domain,pzisiauywa.xin,detect,low,2026-12-22,PAPERMILL DGA-pattern cluster member resolves to 103.23.172.15,campaign:PAPERMILL;tier:dga
domain,gisudyawz.ink,detect,low,2026-12-22,PAPERMILL DGA-pattern cluster member resolves to 103.23.172.15,campaign:PAPERMILL;tier:dga

Behavioral Signaturesnot hash/IP based

# PAPERMILL behavioral pivots -- durable across payload rebuilds
mutex: xkoqvgcojtqgi (VenomRAT runtime mutex)
campaign_group: "Default" (VenomRAT builder campaign identifier)
version_banner: "Venom RAT + HVNC + Stealer + Grabber  v6.0.3" (note: two spaces before v6.0.3)
pe_sections: .nvdata (appears multiple times), .nvtext, .pdata (misleading names -- the .pdata section carries no real exception directory)
internal_dll_name_pattern: libcurl.dll_<digits>.dll (e.g. libcurl.dll_38768.dll) -- the digit suffix is per-build; more durable than the on-disk libcurl.dll filename alone
staging_temp_filenames: *_dbg_src.tmp, *_dbg_dst.tmp (written during LIBCURL.DAT decryption)
loader_memory_base: maps at 0x00000002FFF20000 (no relocations) inside GUP.exe or RuntimeBroker.exe -- GUP.exe is Notepad++'s own legitimate updater component and is a second masquerade/injection target worth baselining alongside RuntimeBroker.exe
persistence_path: %APPDATA%\Microsoft\Crypto\RuntimeBroker\ (RuntimeBroker.exe dropped here, NOT System32)
venomrat_runtime_dir: %APPDATA%\MyData\
persistence_registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
dropped_filenames: RuntimeBroker.exe, libcurl.dll, libcurl.dat
anti_kill: RtlSetProcessIsCritical(TRUE) -- can BSOD the host on a blind process kill if the builder's BS_OD flag is set (reported off in this build); see §14 containment note
master_key_pbkdf2: salt "VenomRATByVenom" (50000 iterations, SHA-1 HMAC); key ASCII pYkMMX7nP7idsNYX2UZF4GQmQG26h2cV (base64 cFlrTU1YN25QN2lkc05ZWDJVWkY0R1FtUUcyNmgyY1Y=)
email_subject_pattern: कर लेखापरीक्षा परिणाम No. ITD/SCNU/2026-<seq> (primary September chain); कर दंड सूचना – भारत सरकार (sister lure, July 2026 waves)
email_mailer_tell: unrendered {{seq}} token surviving in the sender's From display name on some deliveries
signing_cert_thumbprints: SHA1 009a05eaf082d20ae13a65abda12afd959cd76de / SHA256 f72bf7c1fd132262715820d839e4874c97d927b10072fb4709a1321927fea66d (CN=VenomRAT, C=CN, L=SH, O=VenomRAT By qwqdanchun, OU=qwqdanchun, CN=LMTEAM Server)

Named Malware / Toolingcontext

RAT: VenomRAT v6.0.3 (builder attributed to "qwqdanchun")
Loader: Donut 0.9.2 (public position-independent-code shellcode generator)
Container tooling: PyCdlib (Python ISO 9660 authoring library)
Cipher chain: XOR -> bitwise NOT -> Fisher-Yates shuffle -> RC4 (decrypts LIBCURL.DAT)
Cluster designation: PAPERMILL (JUMPSEC DART naming; NOT an established/attributed actor alias)
Related-but-distinct cluster: Silver Fox (China-nexus; PAPERMILL shares tradecraft but is explicitly NOT attributed to it -- see §2)
Cross-campaign pivot lead (not scored as an IOC): a related phishing certificate referenced by JUMPSEC only via its own domain, ekl1-neettr.bond, sharing the same sending IP as the core September chain -- worth an analyst's independent look but outside the PAPERMILL delivery chain proper

Patch / ASR / Config Auditchecklist

# Quick tenant audit before relying on this pack's coverage
1. Confirm ImageHash (module-load) telemetry is enabled and not down-sampled -- required for Q2/Q3
2. Confirm ASR rule "Block executable content from email client and webmail" (be9ba2d9-53ea-4cdc-84e5-9b1eeee46550) is in Block mode, not Audit
3. Confirm ASR rule "Block executable files from running unless they meet prevalence/age/trusted list criteria" (01443614-cd74-433a-b99e-2ecdc07bfc25) is in Block or Audit mode
4. Check whether the native ISO/IMG double-click-mount shell handler is still enabled fleet-wide (Windows.IsoFile\shell\mount) -- see §12/§13
5. Confirm mail gateway rule exists for ISO/IMG attachment types (including nested in .zip)

Detection Validation Gates

Gate	Requirement	Status Before Deploying
Telemetry ready	ImageHash, ProcessRollup2, AsepValueUpdate, NetworkConnectIP4, DnsRequest all flowing for target host population	Verify per §10 Patch/Audit checklist
Benign baseline	Run Q1-Q6 in a 30-day lookback against a representative host sample before enabling alerting	Not yet run — pilot required
Positive tests	No live PAPERMILL sample available for detonation-testing in this research pass (defensive-only scope)	Recommend validating Q3/Q4 logic against a benign signed-binary-plus-DLL test fixture in a lab VM before promotion to IOA
Promotion criteria	Q3 and Q4 promote to Custom IOA only after a 2-week Monitor-mode pilot shows an acceptable false-positive rate (§9)	Pending pilot

Hardening — Tiered

Immediate (this week)

1. Block ISO/IMG attachments at the email gateway (incl. nested in .zip/.7z) — M1031 Network Intrusion Prevention / mail-flow content-type rule. No formal CIS/vendor benchmark entry for this specific control; ⚠ best-practice, no formal benchmark — but it is the single highest-leverage control against this campaign's delivery mechanism. Verify: send a test message with a benign .iso attachment through the gateway and confirm it is quarantined/stripped.

2. Disable the native ISO/IMG double-click auto-mount shell verb fleet-wide — M1038 Execution Prevention. Removes the one-click mount step the whole chain depends on. Verify: double-clicking a benign .iso on a hardened test host no longer offers to mount it (§13 playbook 1 has the exact registry change and rollback).

3. Block outbound to the reported C2 (154.36.188.201:4449) and known delivery domains at the perimeter firewall / Falcon network-containment policy — M1037 Filter Network Traffic. Verify: attempt an outbound connection to the IP/port from a test host and confirm it is dropped/logged.

Near term (1-4 weeks)

4. Enable/enforce ASR rule "Block executable content from email client and webmail" (GUID be9ba2d9-53ea-4cdc-84e5-9b1eeee46550) and "Block executable files from running unless they meet prevalence/age/trusted list criteria" (GUID 01443614-cd74-433a-b99e-2ecdc07bfc25) — M1038, Microsoft Defender ASR reference. Pilot on a ring in Audit mode for 1 week, review event log 1121/1122, then promote to Block. Verify: Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids shows both GUIDs in Block mode.

5. WDAC/AppLocker publisher+path rule restricting Notepad++'s known signing certificate to execute only from %ProgramFiles%\Notepad++\ — M1045 Code Signing, CIS Microsoft Windows 11 Benchmark §18 (application control). Verify: copy the legitimate Notepad++ binary to a non-standard path and confirm it is blocked from executing.

Strategic (1-3 months)

6. WDAC policy allow-listing DLL load paths — block DLL loads from optical/removable/user-writable directories fleet-wide — M1022 Restrict File and Directory Permissions. Requires piloting; strict DLL path control can break line-of-business software. Verify: attempt to load a test DLL from %APPDATA% into an allow-listed application and confirm the block event fires.

7. Harden Run/RunOnce registry key write permissions and build persistent-key change alerting — M1024 Restrict Registry Permissions, plus a SIEM correlation rule for RunOnce writes from non-Program-Files processes (mirrors Q5). Verify: attempt a RunOnce write as a standard (non-admin) user from a test AppData-resident binary and confirm it is either blocked or generates an alert.

Deployable Playbooks

Playbook 1 — Disable native ISO/IMG double-click auto-mount

Prerequisites: Local admin / GPO deployment rights; test on a pilot ring before fleet-wide push. Reboot required: No — takes effect on the next Explorer session (sign-out/sign-in recommended for a clean test, but not required). Rollback: re-import the exported key backup below, or re-create the shell\mount subkey with its original default verb value.

# Step 1 -- BACK UP the current key before changing anything (required for rollback)
reg export "HKCR\Windows.IsoFile\shell\mount" "$env:TEMP\IsoFile-mount-backup.reg" /y

# Step 2 -- disable the "Mount" verb so double-click no longer auto-mounts ISO/IMG files
reg add "HKCR\Windows.IsoFile\shell\mount" /v "ProgrammaticAccessOnly" /t REG_SZ /d "" /f

# Step 3 (GPO deployment) -- push the above via a Group Policy Preferences registry item
# targeting HKEY_CLASSES_ROOT\Windows.IsoFile\shell\mount, scoped to a pilot OU first.

# --- ROLLBACK ---
reg import "$env:TEMP\IsoFile-mount-backup.reg"

Playbook 2 — ASR rule deployment (Audit -> Block)

Prerequisites: Microsoft Defender Antivirus in active mode (or EDR-in-block-mode with Defender AV as the ASR-capable engine); Intune or GPO management. Reboot required: No. Rollback: re-run the same cmdlet with AttackSurfaceReductionRules_Actions Disabled for the affected GUIDs, or remove the Intune/GPO policy and allow local settings to take over.

# Pilot in Audit mode first
Set-MpPreference -AttackSurfaceReductionRules_Ids be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,01443614-cd74-433a-b99e-2ecdc07bfc25 -AttackSurfaceReductionRules_Actions AuditMode,AuditMode

# After 1 week, review Event Viewer -> Microsoft-Windows-Windows Defender/Operational, Event ID 1121/1122
# for expected-vs-unexpected hits, then promote to Block:
Set-MpPreference -AttackSurfaceReductionRules_Ids be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,01443614-cd74-433a-b99e-2ecdc07bfc25 -AttackSurfaceReductionRules_Actions Enabled,Enabled

# --- ROLLBACK ---
Set-MpPreference -AttackSurfaceReductionRules_Ids be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,01443614-cd74-433a-b99e-2ecdc07bfc25 -AttackSurfaceReductionRules_Actions Disabled,Disabled

Playbook 3 — WDAC publisher+path rule for the Notepad++ signing certificate

Prerequisites: Windows 10/11 Enterprise or Server with WDAC support; existing WDAC base policy to merge into (do not deploy as the only policy without lab validation — a bad merge can block unrelated signed binaries). Reboot required: Yes, on first WDAC policy deployment to a host that has none; No for a policy refresh/merge on a host with WDAC already active. Rollback: redeploy the pre-change base policy XML (kept as WDAC-base-pre-papermill.xml) and run RefreshPolicy(AutoConflictCheck), or remove the merged rule and redeploy.

# 1. Export the current base policy before merging (required for rollback)
Copy-Item "C:\Windows\System32\CodeIntegrity\SiPolicy.p7b" "$env:TEMP\WDAC-base-pre-papermill.p7b"

# 2. Build a publisher+path rule: only trust the Notepad++ signer when launched from its expected path
New-CIPolicyRule -Level Publisher -DriverFilePath "C:\Program Files\Notepad++\notepad++.exe" -FilePathRule "C:\Program Files\Notepad++\*"

# 3. Merge into the existing base policy (test in Audit mode first: -Audit switch when converting to binary)
Merge-CIPolicy -PolicyPaths $existingPolicy,$newRule -OutputFilePath "MergedPolicy.xml"
ConvertFrom-CIPolicy -XmlFilePath "MergedPolicy.xml" -BinaryFilePath "SiPolicy.p7b" -Audit
# after a clean audit-mode pilot period, re-run ConvertFrom-CIPolicy WITHOUT -Audit to enforce

# --- ROLLBACK ---
Copy-Item "$env:TEMP\WDAC-base-pre-papermill.p7b" "C:\Windows\System32\CodeIntegrity\SiPolicy.p7b" -Force
# then: Invoke-CimMethod -Namespace root\Microsoft\Windows\CI -ClassName PS_UpdateAndCompareCIPolicy -MethodName Update

Containment Runbook

Phase	Actions	Owner	Evidence to Preserve
Isolate	Falcon network-contain the host; do not power off (preserves memory-resident VenomRAT/Donut artifacts)	IR / SOC L2	Falcon RTR memory dump if feasible
Triage	Confirm process tree: Notepad++-renamed launcher → libcurl.dll → RuntimeBroker.exe; check for HKCU RunOnce entry and mutex xkoqvgcojtqgi	IR / SOC L2	Process tree export, registry hive snapshot
Eradicate	Kill RuntimeBroker.exe and any cvtres.exe HVNC worker; remove `%APPDATA%\Microsoft\Crypto\RuntimeBroker\`; delete the RunOnce value; remove the mounted ISO/.img and quarantine the source email	IR / Endpoint Eng	Collected samples: RuntimeBroker.exe, libcurl.dll, libcurl.dat/LIBCURL.DAT (before deletion)
Recover	Force-expire and rotate browser-stored credentials and any cryptocurrency wallet credentials accessible from the host (VenomRAT stealer capability); reimage if HVNC/keylogger dwell time is uncertain	IR / IT Ops / affected user	Credential-rotation ticket, reimage confirmation
Post-incident	Block sender domain/IP at gateway, add C2 IP:port to network block list, brief users on the tax-audit lure pattern, confirm §12 Immediate controls are deployed fleet-wide	SOC / Security Awareness	Updated block lists, awareness-comms record

Detection Coverage Map

Technique	Behavior	CQL	IOA	Coverage
T1566.001	Tax-audit phishing, ISO/.img attachment	— (email gateway, §7)	—	Partial
T1553.005	MOTW bypass via mounted image	Q1 (proxy)	—	Partial
T1036.005	Renamed signed Notepad++ binary	Q3	Signed-Binary Sideload Mismatch	Good
T1574.002	libcurl.dll sideload	Q2, Q3	Signed-Binary Sideload Mismatch	Good
T1027	Cipher-chain decryption, misleading PE sections	—	—	GAP — no direct Falcon field for in-file section-name inspection or cipher-chain detection; requires file-analysis tooling outside Falcon telemetry
T1497	Sandbox/VM evasion checks + sleep	—	—	GAP — anti-analysis behavior is only visible to a detonation sandbox, not endpoint telemetry
T1620	Donut shellcode reflective load	—	—	GAP — in-memory reflective loading has no dedicated Falcon field in this pack's data-model reference; the sensor's own behavioral-ML reflective-injection detections are the expected coverage layer, not a hand-written CQL hunt
T1547.001	RuntimeBroker.exe + RunOnce persistence	Q4, Q5	RuntimeBroker.exe Path Anomaly	Good
T1071.001	C2 to 154.36.188.201:4449	Q7, Q8	—	Good (single-source caveat, §2)
T1219	HVNC / RAT remote access capability	Q6 (indirect, worker-process proxy)	—	Partial
T1105	Payload download via download.php	Q8 (domain proxy)	—	Partial

Validation gates: see §11 — no queries in this pack have been benign-baselined or positive-tested against a live sample as of this draft; run the §11 pilot before promoting Q3/Q4 to enforced Custom IOAs.

Hunt Summary Ticket

TITLE: PAPERMILL -- VenomRAT v6.0.3 via ISO/.img + Renamed Signed Notepad++ Sideload
SEVERITY: High (commodity RAT, full remote-access/HVNC/stealer capability; single-source intel -- see CONFIDENCE)
SCOPE: Windows endpoints with email access; targets Indian tax-audit-themed phishing recipients per JUMPSEC
HYPOTHESIS: H1-H8 (see s3) -- highest fidelity: signed-binary/libcurl.dll sideload mismatch (H1) and
            RuntimeBroker.exe path anomaly (H2)
QUERIES: Q1-Q8 (s8); Q3 and Q4 are Custom IOA candidates (s9)
DO FIRST: Run s10 Patch/Audit checklist to confirm ImageHash telemetry is enabled; deploy s12 Immediate
          tier (email ISO/IMG block, disable ISO auto-mount, block C2 IP:port)
FINDINGS: No live detonation performed in this research pass -- defensive/detection-engineering scope only
GAPS: T1027 (cipher-chain/section obfuscation), T1497 (sandbox evasion), T1620 (Donut reflective load) have
      no direct CQL coverage -- rely on sensor behavioral-ML + s7 native hunts for these steps (see s15)
ACTIONS: Deploy s12 tier-1 controls this week; pilot Q3/Q4 as Custom IOAs in Monitor mode per s9/s11;
         validate LIBCURL.DAT hash and secondary C2 IP independently before adding to any blocklist (s4/s10)
OWNER: HuntPack
VERSION: v0.1 (Draft) -- 2026-09-22
CONFIDENCE: Single independent primary source (JUMPSEC DART); all other cited coverage is derivative.
            JUMPSEC: moderate-to-high confidence China-nexus attribution; explicitly NOT attributed to
            Silver Fox ("a Silver Fox family fingerprint, but the specific implementation is a variant,
            not a repetition").

Changelog

v0.12026-09-22Initial draft. Built from JUMPSEC DART primary reporting (2026-09-15) plus four derivative outlets. 8 CQL hunt queries, 2 Custom IOA candidates, 3 deployable hardening playbooks, full containment runbook. All atomic IOCs mechanically traced against 5 saved source snapshots; untraced operator-supplied values (LIBCURL.DAT hash, secondary C2, sibling-sample hashes, DGA domain list, PBKDF2 salt/master key, cvtres.exe detail, MyData runtime path, mail-tracking beacon) excluded or placeholder-flagged per the single-source provenance constraint.

References

Tier	Source	Used For	Access Date
Primary	JUMPSEC DART — An Emerging Silver Fox-Like Cluster: PAPERMILL	Full infection chain, IOCs, attribution confidence framing	2026-09-22
Secondary	GBHackers — PAPERMILL Malware Campaign	Corroborating summary	2026-09-22
Secondary	Cybersecurity News — PAPERMILL Hackers	Hash corroboration, defensive recommendations	2026-09-22
Secondary	Security Online — PAPERMILL Cybercrime Cluster	Most detailed derivative write-up, attribution quote	2026-09-22
Secondary	CyberPress — PAPERMILL Deploys VenomRAT via ISO	Delivery IOC corroboration, Donut framework note	2026-09-22
Reference	MITRE ATT&CK	Technique ID mapping (§6)	2026-09-22