Sophisticated Tax Phishing Campaign Targets Indian Users with Blackmoon Malware

Cybersecurity researchers at eSentire's Threat Response Unit (TRU) have uncovered an ongoing cyber espionage campaign specifically targeting Indian users with sophisticated phishing tactics. The operation employs fake penalty notices impersonating India's Income Tax Department to deliver malware that establishes persistent access to victims' systems.

The attack begins with a ZIP file containing five files, including an executable (Inspection Document Review.exe) designed to sideload a malicious DLL. This DLL performs anti-analysis checks before contacting a command-and-control server (eaxwwyr[.]cn) to retrieve the next payload. Researchers noted the malware employs advanced techniques to bypass security measures:

• COM-based UAC bypass to gain administrative privileges
• PEB manipulation to disguise itself as explorer.exe
• Automated mouse simulation to evade Avast Free Antivirus detection

According to eSentire, "By deploying this system as their final payload, the threat actors establish resilient persistence and gain a rich feature set to monitor victim activity and centrally manage the theft of sensitive information."

The malware ultimately deploys two primary components:

1. A variant of Blackmoon banking trojan (KRBanker) targeting financial data
2. SyncFuture TSM, a legitimate enterprise monitoring tool developed by Chinese firm Nanjing Zhongke Huasai Technology Co., Ltd

This commercial RMM tool provides attackers with capabilities including:

• Remote endpoint control actor real-time user activity monitoring
• Automated data exfiltration
• Granular logging via MANC.exe orchestrator

Practical Protection Measures

Organizations and individuals should implement these defenses:

1. Email Verification: Always validate unexpected tax notices through official channels
2. Application Control: Block execution from temporary directories using tools like Microsoft AppLocker
3. Behavior Monitoring: Deploy endpoint detection that analyzes process behavior rather than signatures
4. Least Privilege Enforcement: Restrict administrative rights using Microsoft LAPS
5. DLL Sideload Protection: Monitor for unsigned DLLs loaded by legitimate executables

Researchers emphasized the campaign's sophistication: "By blending anti-analysis, privilege escalation, DLL sideloading, commercial-tool repurposing, and security-software evasion, the threat actor demonstrates both capability and intent." While attribution remains unclear, the precision targeting of Indian users suggests strategic objectives beyond financial gain.