RustSL
RustSL is a Rust-based modular shellcode loader and antivirus/EDR bypass framework. The provided content describes it as an open-source project with a PyQt5 GUI, plugin-based extensibility, configurable Cargo features, multiple shellcode encoding and encryption options, numerous memory allocation and execution techniques, anti-sandbox and anti-VM checks, and syscall-based execution including indirect and VEH syscalls. It supports payload loading from embedded data, local files, named pipes, mailslots, and remote URLs, and is intended to generate stealthy loaders through static linking, compiler optimizations, stripped binaries, and optional signature/icon changes.
The content also states that threat actors, specifically the Silver Fox group, used modified RustSL variants in phishing campaigns observed from late December 2025 through January 2026. In these campaigns, tax-themed phishing emails impersonating Indian and Russian authorities delivered ZIP or RAR archives containing executables disguised as PDF files. Those executables were modified RustSL loaders that unpacked encrypted payloads, performed environment checks and country-based geofencing, and then downloaded and executed ValleyRAT; in some cases the broader infection chain also led to ABCDoor deployment via ValleyRAT plugins. Reported targeted sectors included industrial, consulting, trade/retail, and transportation organizations.
High-confidence modifications attributed to Silver Fox include added modules named steganography.rs for payload unpacking and guard.rs for environment checks and geofencing. The modified loaders extracted encrypted payloads delimited by <RSL_START> and <RSL_END> and commonly used the hard-coded key RSL_STEG_2025_KEY. Observed geolocation checks queried ip-api.com, ipwho.is, ipinfo.io, ipapi.co, and www.geoplugin.net, with execution allowed for systems in India, Indonesia, South Africa, Russia, Cambodia, and later Japan. At least one sample implemented Phantom Persistence. Specific sample MD5s mentioned in the content are e6362a81991323e198a463a8ce255533 and 2c5a1dd4cb53287fe0ed14e0b7b7b1b7.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Злоумышленники использовали модифицированную версию Rust-загрузчика под названием RustSL... APT-группа Silver Fox впервые стала применять модифицированную версию RustSL в конце декабря 2025 года.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniquesThe activity involved using phishing emails that mimic correspondence from the Income Tax Department of India in December 2025, followed by a similar campaign aimed at Russian entities.
Обе волны имели почти идентичную структуру: фишинговые письма оформлялись как официальные уведомления о проведении налоговых проверок или предлагали загрузить архив с «перечнем налоговых нарушений»... В декабрьской рассылке вредоносный код содержался непосредственно в приложенных к письму файлах.
В январской рассылке жертвам приходило письмо якобы от налоговой службы с вложенным PDF-файлом... В PDF-файле присутствовали две кликабельные ссылки для загрузки архива, ведущие на вредоносный ресурс.
Execution
2 techniquesОба варианта рассылки пытаются сыграть на важности писем от налоговых органов, чтобы убедить жертву скачать документ и запустить цепочку атаки.
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
5 techniquesоригинальная версия RustSL по умолчанию шифрует все строки и добавляет мусорные инструкции для усложнения анализа... Запускаемый JS-скрипт сильно обфусцирован
Цепочка заражения начинается с того, что пользователь запускает исполняемый файл ... с иконкой PDF- или Excel-файла.
guard.rs... реализует различные проверки среды и страны запуска. В самых первых образцах загрузчиков ... использовала все доступные методы обнаружения виртуальных машин и песочниц
Discovery
4 techniquesguard.rs... реализует различные проверки среды и страны запуска. В самых первых образцах загрузчиков ... использовала все доступные методы обнаружения виртуальных машин и песочниц
В более поздних версиях осталась только геолокационная проверка... Для определения страны Silver Fox RustSL отправлял запросы на пять публичных сервисов
Another module added to Silver Fox RustSL is guard.rs. It implements various environment checks and country-based geofencing.
The end goal of the Silver Fox RustSL variant is to unpack the encrypted malicious payload, while implementing country-based geofencing... While the GitHub variant only includes China in its country list, the bespoke version features India, Indonesia, South Africa, Russia, and Cambodia.
Command and Control
1 techniqueОн скачивал и запускал известный бэкдор ValleyRAT... модуль пытался несколькими способами загрузить с жестко закодированного адреса архив размером 52,5 МБ.
IOCs tracked for this family
55 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RustSL is a modified Rust-based loader adapted by Silver Fox from a public GitHub repository. The customized version includes steganography-based payload unpacking, environment checks, and country-based geofencing. It disguises itself with PDF or Excel icons, loads encrypted shellcode, downloads ValleyRAT components, and implements 'Phantom Persistence' by intercepting shutdown signals and forcing reboot-based re-execution.
An open-source shellcode loader whose modified variant unpacks encrypted malicious payloads, performs geofencing and environment checks, establishes persistence via Phantom Persistence, and downloads ValleyRAT.
An open-source shellcode loader and antivirus bypass framework modified by Silver Fox to unpack encrypted payloads, apply geofencing, perform VM/sandbox checks, establish persistence in some variants, and download/execute ValleyRAT.
Rust-based loader adapted by Silver Fox for phishing campaigns. It decrypts and launches payloads, performs geofencing and environment checks, supports multiple payload encodings, can fetch encrypted payloads from local archives or remote resources, and in some samples uses Phantom Persistence to survive reboot.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.