China Linked PAPERMILL Campaign Uses Tax Phishing to Deploy VenomRAT

JUMPSEC’s Detection and Response Team has identified PAPERMILL, a suspected China-nexus cybercrime cluster targeting enterprises, particularly organisations in India. The campaign uses phishing emails carrying .img disk images disguised as urgent tax notices. The images contain a legitimate, digitally signed Notepad++ executable renamed to resemble an official tax document, a malicious libcurl.dll library and an encrypted payload.

When the executable runs, Notepad++ loads the attacker-controlled DLL through sideloading. Because files in mounted disk images do not inherit Windows’ Mark-of-the-Web, SmartScreen and download warnings may not appear.

The loader uses obfuscation, environment checks and a five-minute delay to hinder automated analysis. It decrypts the payload using bitwise operations, shuffling and RC4, then loads Donut shellcode and reflectively executes a .NET binary containing VenomRAT in memory. The remote-access trojan can provide hidden desktop control, record keystrokes and steal credentials, including browser passwords and cryptocurrency wallets.

JUMPSEC assesses the activity with moderate-to-high confidence as China-nexus, while noting behavioural similarities to Silver Fox but different tooling; the relationship remains uncertain. Researchers also found infrastructure linked to Chinese internet service providers dating back to 2021 and disk images referencing Indian tax authorities. Dynamically generated images produce different hashes, limiting hash-based detection.

JUMPSEC recommends blocking ISO and IMG attachments, restricting virtual-disk mounting on ordinary workstations, monitoring trusted software for unexpected DLL loads and alerting on unsigned libraries placed beside signed utilities. Staff should verify unexpected tax or financial messages through official channels.