An emerging phishing campaign dubbed “PAPERMILL” is using a trojanized, signed version of Notepad++ to launch VenomRAT under the guise of a tax audit notice. The operation tricks recipients into opening a disk image that then simulates mounting a local drive, bypassing usual warning flags tied to files downloaded from the internet. Valid email authentication checks like SPF, DKIM, and DMARC are passed, lending legitimacy to the lure.
How the Attack Unfolds
The campaign begins with an email claiming to be a tax audit. Attached is a disk-image file (ISO/IMG) that, when mounted, reveals a renamed, legitimately signed Notepad++ executable alongside a malicious library (DLL) and an encrypted payload. The signed executable itself is unaltered, but it loads the rogue DLL, enabling the malicious code to execute while Windows treats the process as normal. This form of “DLL sideloading” hides the attacker’s code inside what looks like trusted software.
The container strips away the internet origin metadata and security warnings, complicating detection. Misleading section names inside the files further obfuscate the payload. Once launched, the loader checks whether it’s running in an analysis or sandbox environment—looking for characteristics like low memory, short uptime, or low display resolution—and introduces delays to avoid detection. After passing these checks, the loader seeks elevated access, establishes persistence via RunOnce registry entries, and stages components in user profile directories.
VenomRAT & Targets
PAPERMILL delivers VenomRAT version 6.0.3, which includes features for hijacking virtual desktops (HVNC), stealing data, and grabbing files. It connects to remote command-and-control servers, enabling account takeover, surveillance, or further intrusion once the victim engages. Researchers believe this campaign is aimed primarily at targets in India, given the tax-lure themes and infrastructure links. Some techniques overlap with those used by groups like Silver Fox, though researchers caution these similarities do not confirm shared authorship.
Key indicators of compromise (IoCs) have been identified: sender domains, IPs, specific file hashes (for the ISO, signed launcher, DLL, encrypted payload, and RAT component), file installation paths (e.g. in %APPDATA%), masqueraded filenames, persistence mechanisms, and named remote servers. Details include how the signed executable masquerades as a trusted process (e.g. RuntimeBroker.exe) and loads DLLs under misleading names.
Mitigation Advice
This campaign shows that email authentication checks are not sufficient defenses. Recipients should treat unexpected disk-image files and tax-themed notices as potentially malicious. Security teams are advised to block or heavily scrutinize IMG/ISO attachments, monitor for signed binaries loading unsigned or out-of-place DLLs, and investigate unusual persistence entries and network traffic originating from trusted processes. File-hash-based defenses are weak in this context, since attackers can generate new containers, meaning defenders should focus on patterns in filenames, DLL behavior, configuration artifacts, and communication endpoints.
PAPERMILL’s layered use of social engineering, trusted software, encrypted payloads, and signed binaries illustrates how adversaries are adapting to evade traditional security controls. Organizations of all sizes are at risk if policies are not updated to address these tactics.
Why it matters: This isn’t just another phishing scam. PAPERMILL demonstrates how adversaries are abusing the trust model baked into signed software, combining it with advanced techniques like DLL sideloading and delayed payload execution to evade detection. As software supply chain defenses improve, attacks like this are likely to grow. Security teams must rethink reliance on file signatures and hashes alone, and invest in anomaly detection, behavioral analysis, and robust monitoring of process behavior and configuration changes.
