Attack on Indian Government, Financial Institutions

Zscaler ThreatLabZ documents a targeted April 2020 phishing campaign against Indian government and banking organisations that delivered an HTA-based JsOutProx RAT and an obfuscated Java backdoor via malicious archive attachments; the report includes static and dynamic technical analysis, persistence and C2 behavior, plugin capabilities (file manager, screen capture, command execution), MITRE ATT&CK mapping, and IOCs (MD5 hashes and DDNS C2 domains).