PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks
The PAPERMILL threat cluster is employing a sophisticated phishing campaign that uses a signed Notepad++ executable to deliver the VenomRAT malware, disguised as fake tax audit notices.
A sophisticated phishing campaign, tracked as PAPERMILL, is currently distributing the potent VenomRAT malware by leveraging a signed, yet compromised, version of the Notepad++ text editor. Threat actors are sending out emails with fake tax audit notices, which contain a disk image attachment designed to bypass standard security checks. This tactic aims to disguise the malicious payload as a routine document, making it more likely for recipients to open it.
Upon mounting the disk image, users are presented with what appears to be a legitimate drive. Within this image, attackers have replaced a legitimate, signed Notepad++ executable with a renamed version. This executable is then configured to load a malicious DLL, a technique commonly known as DLL sideloading. This method allows the malware to execute under the guise of a trusted application, significantly increasing its chances of evading detection by security software and user suspicion.
The campaign's tradecraft bears similarities to the Silver Fox ecosystem, though researchers are cautious about direct attribution, noting key differences in the tools and techniques employed. The use of a signed executable is a critical element of this attack, highlighting that a valid digital signature does not guarantee the safety of an entire file set. This layered approach, combining a familiar lure with a trusted application and a cleverly disguised loader, helps attackers bypass basic security controls and complicates incident response efforts.
The malicious chain begins with the disk image, which, when mounted, presents the renamed signed executable alongside a counterfeit library and an encrypted data file. This setup helps strip the 'Mark of the Web' from files, reducing the security warnings typically displayed by Windows for internet-downloaded content. The signed executable itself remains unaltered, but its renaming allows it to load the adjacent malicious library, effectively executing the attacker's code.
Further complicating analysis, the rogue DLL employs misleading section names to confuse security tools. It then decrypts its data file and launches the next stage of the payload directly from memory. The loader also includes anti-analysis features, delaying execution for five minutes if it detects an environment resembling automated analysis, such as low memory, limited storage, or a short system uptime.
After passing these checks and potentially seeking administrator approval, the malware establishes persistence through a RunOnce entry and copies its components into user profile folders. It then utilizes a Donut shellcode loader to execute a .NET payload in memory. This layered delivery mechanism, culminating in the deployment of VenomRAT version 6.0.3, equips the malware with capabilities such as hidden virtual network computing, data-stealing, and file-grabbing functionalities.
The recovered configuration indicates that the attackers are focused on targets related to Indian tax matters. While links to China-connected infrastructure and similar tax lures have been observed, the distinct choice of host program, loader, and remote-access tool suggests either a distinct actor within a broader ecosystem or sophisticated copycat activity. Organizations are advised to treat unsolicited tax notices and unexpected disk image files with extreme caution, verifying any tax-related requests through official channels and implementing robust endpoint detection and response measures.