Indian Income Tax-Themed Attacking Businesses with a Multi-Stage Infection Chain

A tax-themed spear-phishing campaign targets Indian businesses by sending emails impersonating the Income Tax Department; recipients are instructed to open a PDF that leads to a fraudulent portal which downloads a ZIP containing an NSIS-based installer. The installer deploys a persistent Remote Access Trojan (service name NSecRTS.exe) that communicates with C2 servers over non-standard ports (48991/48992), with indicators and artifacts (file names, ports, code-signing language) suggesting a China-linked development environment.