DcRAT Operation DragonReturn: Mixed Reality.exe Injector → svchost.exe C2 Beacon

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects DcRAT (Operation DragonReturn) malware beaconing to a known C2 IP address (223.26.63.40) following the execution of suspicious sideloaded binaries, specifically 'Mixed Reality.exe' or 'COU_ITR-1_to_4_AY2026-27.exe', which then inject malicious code into svchost.exe.