OTX Threat: Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain

A sophisticated phishing campaign targeting Indian businesses and taxpayers leverages GST-related themes to distribute Remcos RAT through a multi-stage .NET framework. Threat actors impersonate Government of India GST communications using fraudulent refund notifications with convincing ARN references. The attack chain begins with a malicious RAR archive containing a .NET executable that employs bi Sectors: Finance, Government