PAPERMILL Malware Campaign Abuses Signed Notepad++ to Deliver VenomRAT to Windows Users

A newly identified phishing operation tracked as PAPERMILL is abusing a legitimately signed Notepad++ executable, DLL sideloading, and layered in-memory loaders to install VenomRAT on Windows systems.

The campaign uses tax-audit lures aimed at Indian recipients and reflects a broader China-nexus pattern of tax-themed malware activity, although the available evidence does not support definitive attribution to a named group.

The email used a tax-audit subject line and carried an attachment named Tax_Notice_45594.exe. Despite its filename, the attachment was an ISO 9660 disk image masquerading as an .img file.

The container was programmatically generated with PyCdlib, a Python ISO-generation library.

Its first 32 KB contained the expected zero-filled ISO system area, followed by the CD001 primary volume descriptor at sector 16.

The image held three files: a renamed, signed Notepad++ executable named Tax_Notice_45594.exe, a malicious libcurl.dll, and an encrypted payload stored as LIBCURL.DAT.

Using an ISO is central to the infection chain. When a user mounts the downloaded image, files extracted from the virtual disk may not carry Mark-of-the-Web metadata in the same way as files opened directly from conventional downloaded archives.

That weakens browser, Explorer, Office, and SmartScreen trust warnings that commonly rely on internet-zone markings, turning a downloaded payload into something that appears more locally trusted.

The executable itself is not modified malware. PAPERMILL operators instead rename a legitimate Authenticode-signed Notepad++ binary and rely on DLL search-order behavior to load their adjacent libcurl.dll.

The rogue library exports only four functions curl_easy_setopt, curl_easy_cleanup, curl_easy_init, and curl_easy_perform matching the API surface imported by the legitimate host.

This DLL proxying approach lets Notepad++ start normally while the malicious DLL executes its loader logic in DllMain, before any expected curl-related function calls are made.

PAPERMILL Malware Campaign

The combination of a trusted executable and a companion DLL is a familiar sideloading pattern.

The EXE is MSVC 2022 (19.36.33811) and Authenticode-signed; the DLL sitting next to it is a MinGW/GNU-ld (Binutils 2.38) build.

JUMPSEC said in a report shared with GBhackers, the activity after a phishing message reached a customer inbox despite passing SPF, DKIM, and DMARC validation.

Recent Silver Fox-linked campaigns against Indian organizations have similarly used tax-themed phishing, legitimate executables, and malicious DLLs to execute RAT payloads, though those operations have typically relied on Thunder/Xunlei binaries and libexpat.dll, not Notepad++ and libcurl.dll.

The malicious DLL attempts to frustrate both analysts and automated sandboxes.

Its PE section names are deliberately misleading: code resides in sections labeled .nvdata, while read-only data appears under .nvtext; a section called .pdata contains import-related data rather than a genuine exception directory.

On execution, the loader checks for typical sandbox conditions, including a single-core CPU, less than 4 GB of RAM, low available disk space, uptime below 10 minutes, a static mouse cursor, limited screen resolution, and no recent user input.

Instead of terminating when a check fails, it sleeps for five minutes, a tactic designed to outlast short automated-analysis windows.

If the process lacks administrative rights, it invokes the runas verb and repeatedly prompts for User Account Control approval.

Once elevated, the loader establishes persistence through Registry changes and decrypts the payload held in LIBCURL.DAT.

The decrypted blob contains a Donut-style position-independent shellcode loader that reflectively loads a .NET assembly.

Donut is an open-source framework frequently abused to execute managed assemblies and PE payloads directly in memory.

The final .NET payload was identified as VenomRAT rather than a generic AsyncRAT or Quasar derivative through distinctive code and configuration artifacts, including the VenomRATByVenom PBKDF2 salt, D/Invoke components, ProcessCritical functionality, and HVNC-related process handling.

The recovered configuration pointed to 154.36.188.201:4449 and identified the implant as Venom RAT + HVNC + Stealer + Grabber v6.0.3.

VenomRAT’s broad capability set can enable remote access, data theft, hidden virtual network computing, and credential collection.

Infrastructure and lure patterns place PAPERMILL close to the broader Silver Fox ecosystem, which has repeatedly targeted Indian users with tax-related phishing and DLL-sideloaded RAT deployments.

Public reporting has documented Silver Fox campaigns using income-tax decoys, trusted executables, anti-analysis logic, Donut-based loading, and ValleyRAT payloads.

However, PAPERMILL differs materially in its tooling: ISO delivery, Notepad++ sideloading, libcurl.dll, Donut-loaded VenomRAT, and its observed C2 infrastructure.

The most defensible assessment is that PAPERMILL is China-nexus, financially motivated, and Silver Fox-adjacent rather than conclusively operated by Silver Fox itself.

The campaign also demonstrates why defenders should treat signed binaries as contextual trust signals not proof that execution is benign.

Indicators of Compromise

Type	Indicator
Sender address / DKIM domain	dfgfasd@hsaui[.]cc
Sending IP	155.94.154.195
Sending MTA (HELO/PTR)	mos1.17dlz[.]cn
Bulk-mailer auth host	smtp.smtpman[.]cn

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.