Operation DragonReturn DcRAT Phishing: Indian Income Tax PDF Lure with govtop.one

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies specific malicious attachment filenames, suspicious URLs, subject lines, and sender domains commonly used in these campaigns to deliver malicious content.