Operation DragonReturn: JPEG-disguised payload download and decode (T1027.003)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•13

Detects the download of JPEG image files to suspicious system directories (e.g., C:\Windows\, C:\ProgramData\) followed by subsequent file read operations by non-image viewer processes, which is indicative of steganographic payload extraction used in campaigns such as Operation DragonReturn/DcRAT.