Fake GST Refund Emails Spread Remcos RAT to Indian Firms

A recent GST phishing campaign has been identified targeting Indian businesses, using fake tax refund emails to distribute Remcos RAT malware. Attackers disguise malicious emails as official communication, leading victims to open infected attachments. The campaign utilizes techniques such as fileless execution and privilege escalation to evade detection and steal sensitive information.

Key characteristics include spear-phishing delivery via RAR attachments, embedded executables, and remote control capabilities after infection. Recommendations for defense include employee training, verifying suspicious communications, and implementing strict email filtering and monitoring protocols.