Loading malware…
SilentRunLoader is a Python-based loader and information stealer associated with the Chinese-speaking, financially motivated threat cluster TA4922, which has overlap with the broader Silver Fox ecosystem. It has been used in campaigns targeting organizations in the United Kingdom and Southeast Asia, particularly through localized tax, benefits, compliance, and other business-themed social-engineering lures. Delivery has been observed via phishing emails and DLL sideloading, often as part of broader intrusion chains intended to establish access, steal data, and stage additional tooling.
The malware combines loader and browser-theft functionality. It is used to stage additional payloads while also harvesting data from Google Chrome, including stored credentials, cookies, and browsing information. Reported behavior includes collecting browser data, packaging stolen information for upload, exfiltrating it to attacker-controlled infrastructure, and downloading or dropping an additional executable as a next-stage component. This dual-use design makes it both an access-enablement tool and a direct data-theft mechanism.
SilentRunLoader has been linked to campaigns in which TA4922 impersonated tax authorities and other trusted business functions to increase victim interaction. Its use reflects the actor’s broader pattern of localized phishing, rapid tooling iteration, and reliance on DLL sideloading and legitimate services to reduce detection. Researchers have also assessed with high confidence that some newer Python malware in this toolkit, including SilentRunLoader, was likely developed with assistance from large language models, based on coding artifacts and placeholder values. Within TA4922 operations, SilentRunLoader represents a notable evolution toward quickly produced, multifunctional malware focused on browser data theft and follow-on payload delivery on Windows systems.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recent campaigns delivered a newly identified backdoor, Atlas RAT, alongside two fresh loader families Proofpoint named RomulusLoader and SilentRunLoader...
The disclosure comes as Silver Fox continues to actively refine and expand its arsenal with new tools, such as Atlas RAT (aka AtlasCross RAT), RomulusLoader, and SilentRunLoader...
14 distinct techniques documented for this family, organized by ATT&CK tactic.
In recent months, however, attacks mounted by the hacking group have relied on phishing campaigns using human resources- and business-themed lures for credential phishing, fraud, and malware delivery, including Atlas RAT, RomulusLoader, and SilentRunLoader.
The group sends carefully crafted emails disguised as messages from HR departments, tax authorities, and payroll teams... Once a victim clicks a link or opens an attachment, the malware silently installs itself.
Once a victim clicks a link or opens an attachment, the malware silently installs itself.
Another alarming component of the group’s toolkit is a compiled Python utility called SilentRunLoader .
Proofpoint assessed with high confidence that the group likely uses AI coding tools to rapidly develop new Python-based malware.
The target receives a legitimate executable file and a malicious DLL (the Atlas RAT loader) that is sideloaded into the executable’s process.
Specifically, it harvests saved credentials, session cookies, and local browsing histories directly from Google Chrome .
Specifically, it harvests saved credentials, session cookies, and local browsing histories directly from Google Chrome .
Upon execution, the payload installed SilentRunLoader which harvested sensitive data from Google Chrome including stored credentials, cookies, and browsing information.
It then packs these data files into a zip archive and uploads them to a remote server .
Atlas RAT ... connected to a command-and-control server at 206.238.115.58 over port 886... Network defenders should flag traffic to unusual ports, particularly port 1234, used by RomulusLoader’s C2 infrastructure.
Payloads were typically installed through DLL sideloading and staged from consumer file-sharing services.
It then packs these data files into a zip archive and uploads them to a remote server .
Collected data was exfiltrated via HTTP POST requests to C2 infrastructure hosted at “ws[.]ztts88[.]cyou” which resolved to IP address 18[.]139[.]83[.]110.
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.