Threat Research has identified an active, multi-stage cyber operation tracked as TAX#TRIDENT, which weaponizes fake Indian Income Tax-themed lures to compromise Windows endpoints. Rather than operating as a net-new malware strain, the campaign marks a calculated evolution in how historical tax decoys are recycled and expanded across modern network infrastructure. The true structural novelty of TAX#TRIDENT lies in its fluid deployment framework, leveraging a singular social engineering hook to simultaneously feed three entirely independent execution branches. These delivery routes scale from elementary compressed file extractions to multi-stage VBScript downloaders and full enterprise endpoint-management enrollments. For corporate security operations centers, this polymorphic delivery pipeline demonstrates that static, hash-centric defenses are fundamentally inadequate, forcing security teams to pivot toward rigorous behavioral hunting methodologies to intercept the campaign before durable access is established.
Technical Breakdown of the Three Core Execution Paths
Infection Chain 1: Direct Web Archive to ClientSetup Deployment
The primary infection route initiates via a direct delivery chain hosted on the malicious infrastructure zyisykm.shop, which mimics an official Indian Income Tax assessment or penalty notification portal. When a target interacts with the site’s download trigger, an nginx server delivers an “Assessment Letter.zip” archive—a tactical file extension choice intended to mirror a standard corporate document package rather than an unsafe direct executable. Inside this archive sits a signed 32-bit Windows binary that functions as a larger enterprise-style endpoint control setup package rather than a simple standalone backdoor. Upon activation, the installer binary dynamically parses its own filename to extract its destination command-and-control (C2) IP node (45.119.55.66) and commits this runtime variable directly into an operational configuration file known as YTSysConfig.ini. The installer establishes a hidden staging root at C:\Windows\SysWOW64\msres , achieving persistent execution by spinning up a dedicated Windows service named MANC and anchoring low-level kernel-mode drivers like YtMiniFilter.sys and ytdisk.sys to attain deep file and disk monitoring capabilities. The deployment concludes by executing a counterfeit svchost.exe process from the malicious directory, which opens sustained, asymmetric socket connections to the hardcoded C2 infrastructure over TCP ports 6671 and 6681 to maintain persistent tasking and heartbeat polling.
Infection Chain 2: VBScript Downloader and Dual-Channel Infrastructure
The second operational branch maintains structural payload parity with the primary chain but introduces a highly stealthy script-centric delivery mechanism anchored by a downloader named Assessment_Order.vbs. Disseminated through an array of rotating, lookalike domains, the script employs basic defensive evasion techniques, utilizing On Error Resume Next to suppress fatal script crashes and programmatically forcing itself to relaunch silently in batch mode via wscript.exe //B to drop interactive windows. Operating out of a plausible system directory (C:\SystemUpdates), it relies on Windows Management Instrumentation (WMI) queries and lock files to prevent duplicate executions while fetching an official-looking tax decoy image from tengxxi.com to distract the victim. While the user reviews the decoy interface, the script fetches and hides the identical signed ClientSetup.exe installer binary under a fresh C2 routing target at 216.250.104.166. This secondary infrastructure utilizes a dual-channel command architecture: TCP port 6671 acts as a low-bandwidth, long-lived interactive session, while port 6681 manages a high-volume data channel engineered for heavy tasking payloads, tool drops, and continuous telemetry returns.
Infection Chain 3: Web-Disguised Scripts and Rogue UEMS Agent Enrollment
The final and most sophisticated delivery chain pivots away from standard payloads entirely, exploiting a deceptive web endpoint (xhxz.info/download.php) that serves raw VBScript disguised behind a standard web application extension. Once executed by the local scripting subsystem, it builds a randomized workspace under C:\Users\Public\Documents\MSUpdate_<random>\ and implements masquerading tactics by copying legitimate utilities like curl.exe and bitsadmin.exe into the folder under fake DLL designations (winhttp.dll and wininet.dll) to mask network commands. The script then reaches out to hardcoded AWS S3 storage buckets to retrieve downstream staging artifacts. The first payload, a script named uacMC.png, evades standard inspection via its image extension while rewriting the registry value ConsentPromptBehaviorAdmin to 0 to degrade local User Account Control (UAC) prompt policies. Next, a coordinating script (1122.vbs) downloads a dense zip archive (8081.zip) containing a completely legitimate, signed ManageEngine Endpoint Central/UEMS agent package. By manipulating an accompanying DCAgentServerInfo.json file, the script explicitly directs the agent to connect back to a rogue external management handler at 202.61.160.201:8383 , executing a completely silent, unauthorized enterprise software enrollment using hidden msiexec.exe /qn configurations.
Tooling Attribution and Geopolitical Context
Granular code and metadata analysis of the core ClientSetup binary lineage provides explicit markers pointing back to Chinese commercial development libraries. Binary fields consistently display Simplified Chinese localization string blocks, non-random comments, and distinct operational signatures matching Yangtu and SyncFuture enterprise software frameworks. These specific configurations deeply match historical tracking patterns associated with YTSCRat espionage activity targeting public and private entities within India.
However, security teams must treat these indicators carefully; tooling alignment does not constitute definitive actor attribution. While the forensics firmly establish the structural exploitation of Chinese enterprise toolsets to secure remote monitoring and persistence, the evidence at this stage cannot conclusively verify the precise identity of the human operator behind the keyboard or confirm unified infrastructure ownership across all three independent campaign variants.
Our Opinion on the TAX#TRIDENT Campaign
The TAX#TRIDENT campaign underscores a profound shift in modern cyber espionage tactics, moving away from boutique, custom-crafted malware towards the systematic weaponization of legitimate commercial utilities and enterprise-grade remote monitoring and management (RMM) software. By hijacking frameworks like Yangtu or quietly enrolling systems into rogue ManageEngine UEMS instances, threat actors effectively outsource their development costs while gaining robust, built-in features for persistence, host enumeration, and remote control. This operational strategy cleverly exploits the implicit trust inherent in signed software. Security operations centers often whitelist or overlook administrative tools, presenting an expansive blind spot that attackers can effortlessly navigate.
Furthermore, the adaptation of three distinct delivery chains utilizing a singular social-engineering theme showcases an impressive level of procedural agility. If a defender blocks a direct ZIP-to-EXE download, the actors seamlessly transition to cloud-hosted scripts or web-disguised PHP endpoints that alter UAC constraints. In our opinion, this campaign serves as a critical reminder that atomic indicator-based defense is completely obsolete. True resilience demands behavioral-focused telemetry. Security teams must heavily scrutinize living-off-the-land actions, such as administrative binaries executing from public directories or system tools being renamed to mimic DLLs, to effectively dismantle these multi-pronged operations.
