Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment

Operation DragonReturn is a targeted, APT-style spear-phishing campaign impersonating India's Income Tax Department to push a multi-stage RAT using steganographic payloads, service persistence (MixedSvc), fileless .NET execution with AMSI bypass, and encrypted C2; Seqrite links the infrastructure and TTPs to a China-aligned nexus and provides IOCs, infrastructure details, and MITRE ATT&CK mapping for detection and response.