Catena

Catena is a multi-stage, memory-resident loader observed in phishing-led intrusion chains attributed to the China-based Silver Fox threat group. In the reported campaigns, Silver Fox gained initial access through phishing emails using fake tax audit notices and counterfeit software update alerts, then deployed malware including ValleyRAT, AtlasCross RAT, and the Catena loader. The infection chain included disguised shortcut files and malicious Office documents with hidden macros, with second-stage payloads delivered from cloud storage infrastructure. Catena is described as shellcode-based, and one observed execution chain used DLL sideloading in which WavesSvc64.exe loaded a malicious DuiLib_u.dll that read encrypted shellcode from box.ini, decrypted it, and executed it in memory; this behavior was assessed as consistent with the Catena loader pattern documented by Rapid7. The broader Silver Fox activity targeted businesses and individuals across Asia, including Taiwan, Japan, and Southeast Asia, and expanded to medical institutions, financial companies, and corporate environments. Catena was used alongside other tooling to establish persistence, communicate with remote servers, and support movement within compromised networks. High-confidence related artifacts from the observed Catena-style chain include WavesSvc64.exe, DuiLib_u.dll, encrypted shellcode container box.ini, and the scheduled task Batteries.