Loading threat actor…
Silver Fox is a China-nexus threat group also known as SilverFox, Yinhu (银狐), Void Arachne, SwimSnake, TA4922, and UTG-Q-1000. It targets Chinese organizations and users and has conducted an invoice-themed phishing campaign against a Japanese industrial manufacturer. Its operations have been associated with both espionage and financial gain; Chinese origin does not establish state sponsorship. The group distributes remote-access malware through counterfeit software-download websites, trojanized installers, phishing emails, and instant-messaging lures. Its established malware arsenal includes ValleyRAT, also referred to as Winos4.0, and Gh0st RAT. Silver Fox abuses legitimate, digitally signed applications for DLL sideloading and uses encrypted resources, in-memory payload loading, and process injection to conceal malicious execution. A distinguishing feature is its use of signed kernel drivers to terminate antivirus and endpoint-detection processes, including protected processes. Its loaders support multiple driver alternatives and combine security-tool termination with anti-debugging, sandbox checks, and removal of user-mode API hooks. Persistence mechanisms include scheduled tasks, registry-based payload storage, startup execution, and watchdog components that restore interrupted loaders or injected payloads. Its remote-access tooling supports surveillance, command execution, system discovery, keylogging, screen and clipboard capture, additional payload delivery, and data exfiltration. Attribution based solely on ValleyRAT use or shared infrastructure is insufficient because related tools and techniques are used by other operators.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
50 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
26 malware families attributed to this actor across reporting.
21 additional families tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Driver file wsftprm.sys — Vulnerable signed driver associated with CVE-2023-52271. The campaign uses vulnerable signed kernel drivers to terminate protected antivirus and endpoint-security processes.
The NsecSoft NSecKrnl driver, identified as CVE-2025-68947, is a signed kernel-mode driver that exposes functionality for arbitrary process termination. By exploiting this capability, the ransomware is able to terminate the processes of major EDR and antivirus products...
910 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as background concerning previously reported use of RomulusLoader. The content explicitly states that there is no evidence linking that malware to the ROMULUS delivery panel under investigation; it does not attribute the observed campaigns to Silver Fox.
A Chinese-nexus threat group associated with trojanized software, ValleyRAT/Winos4.0 and Gh0st RAT. The article tentatively links it to Atlas RAT because ValleyRAT and Atlas RAT used the same C2 servers on different ports. This suggests a shared operator but does not establish attribution. The potentially associated Atlas RAT activity includes loader-delivered backdoors and evolving C2 encryption, culminating in TLS communication observed in July 2026.
Conducts cyberespionage using all-in-one loaders that disable endpoint defenses before deploying the ValleyRAT backdoor. The reported campaign abuses Microsoft-signed WatchDog/Zemana-based security drivers to terminate antivirus and EDR processes, including protected processes. Updated samples reportedly modify an unauthenticated Authenticode timestamp byte to change driver hashes while retaining a valid signature.
Distributing a malicious installer masquerading as KakaoTalk through SEO-poisoning redirects, while changing installer packaging among NSIS, Advanced Installer, and Inno Setup.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.