PAPERMILL Hackers Exploit Signed Notepad++ to Deploy VenomRAT in Tax Audits

Key Takeaways

• A new phishing campaign, dubbed PAPERMILL, is actively distributing VenomRAT malware through fake tax audit notifications.
• The attack chain leverages a legitimate, signed Notepad++ executable to sideload a malicious DLL, bypassing traditional security warnings.
• The campaign primarily targets individuals and organizations in India with tax-themed lures.
• Attackers employ sophisticated anti-analysis techniques, including environmental checks and encrypted payloads, to evade detection.
• Defenders should prioritize user education on suspicious emails and attachments, and enhance monitoring for unusual process behavior and DLL sideloading attempts.

A sophisticated phishing operation, identified as PAPERMILL, is exploiting a signed version of Notepad++ to deliver the VenomRAT remote access trojan. This campaign utilizes deceptive tax audit notices and disk image attachments to camouflage dangerous files as legitimate communications, making them appear routine and trustworthy to unsuspecting recipients.

The attack initiates with an email disguised as a tax audit notification. Crucially, these emails are crafted to pass common authentication checks like SPF, DKIM, and DMARC. When a user opens the attached disk image, it mounts as a local drive, circumventing the typical security warnings associated with files downloaded directly from the internet. This technique allows the malicious execution chain to commence without immediate red flags, as detailed in a recent analysis.

Security researchers at JUMPSEC uncovered this activity following a review of a suspicious client email. They characterize PAPERMILL as an emerging threat cluster exhibiting tactics reminiscent of the Silver Fox threat ecosystem, though they have not directly attributed it to that group. JUMPSEC said in a report shared with Cyber Security News (CSN) that this campaign underscores a critical point: a valid digital signature on an application does not guarantee the safety of an entire file set.

The PAPERMILL campaign integrates several elements: a persuasive lure, a widely used and trusted application, a cleverly disguised malicious library, and an encrypted final payload. This layered approach effectively bypasses fundamental security measures, complicating both incident investigation and response for cybersecurity teams.

PAPERMILL Hackers Abuse Signed Notepad++

The phishing email directs recipients to a disk image themed as a tax notice. Once mounted, this container reveals a renamed, legitimately signed Notepad++ application, an illegitimate library, and an encrypted data file. This method is designed to remove the “Mark-of-the-Web” from the contained files, thereby suppressing the security warnings that Windows would typically display.

The core of the exploit lies not in altering the legitimate Notepad++ executable itself, but in manipulating its execution. The original executable remains digitally signed, but it is renamed to facilitate the loading of a co-located malicious DLL. This technique, known as DLL sideloading, enables harmful code to execute within the context of a trusted process, a pattern observed in various recent DLL sideloading campaigns.

The malicious DLL is engineered to expose only the functions expected by the legitimate Notepad++ program. This ensures that the application launches and functions normally, while the malicious loader operates covertly in the background. Furthermore, the loader employs deceptive section names within its Portable Executable (PE) structure, designed to mislead automated analysis tools. It then decrypts its data file and executes the subsequent stage directly from memory.

To further evade detection, the loader incorporates anti-analysis checks. It assesses various environmental factors such as low memory, insufficient free storage, short system uptime, an unmoved mouse cursor, or low display resolution. If any of these conditions suggest an automated analysis environment, the malware introduces a five-minute delay before proceeding, rather than immediately exiting, to thwart sandbox analysis.

VenomRAT Delivery and Defensive Steps

Following these initial checks and delays, the loader attempts to escalate privileges, seeking administrator approval if necessary. It then establishes persistence by creating a RunOnce entry in the Windows Registry and copies its components into user-profile folders. The final stage involves using a Donut shellcode loader to execute a .NET payload in memory. This multi-stage delivery mirrors other VenomRAT campaigns that use disk images, but PAPERMILL adds the critical element of signed-program sideloading for enhanced stealth.

The analysis of the recovered configuration reveals VenomRAT version 6.0.3, equipped with capabilities for hidden virtual network computing (HVNC), data exfiltration, and file grabbing. The command-and-control (C2) server is configured for remote command execution, posing significant risks of account compromise, surveillance, and further intrusion if a victim activates the malicious attachment. Related samples and infrastructure indicate that this campaign is specifically targeting Indian entities with tax-related lures.

Researchers have identified similarities to the broader Silver Fox playbook, including infrastructure linked to China and the use of tax-themed phishing. However, they emphasize key distinctions in the choice of host application, loader, and remote-access tool. This careful distinction is crucial, as shared techniques can point to a common criminal ecosystem or copycat activity, rather than definitively attributing the campaign to a specific named actor.

What You Should Do

• Exercise Extreme Caution with Emails: Treat all unsolicited tax-related emails and unexpected disk image (IMG/ISO) attachments as highly suspicious, even if they appear to pass email authentication checks.
• Verify Independently: Always verify tax-related requests or notices through official, known channels (e.g., government websites, direct phone calls to verified numbers) rather than relying on information or links provided in suspicious emails.
• Enhance Email Gateway Security: Implement strict policies to block or thoroughly inspect IMG and ISO files delivered via email.
• Monitor for Unusual Activity: Deploy robust endpoint detection and response (EDR) solutions to monitor for unusual mounted drives, signed applications loading unexpected DLLs from user-writable directories, unfamiliar RunOnce registry entries, and suspicious network connections originating from trusted or system-like processes.
• Implement Behavioral Analysis: Focus on detecting malicious behavior patterns rather than solely relying on file hashes, as threat actors like PAPERMILL frequently generate new, unique containers. Look for anomalous loader file relationships, library naming conventions, persistence mechanisms, and C2 traffic patterns.
• Educate Users: Conduct regular cybersecurity awareness training for all staff, emphasizing the dangers of phishing, social engineering, and the importance of verifying unexpected attachments.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.