Silver Fox Targets Japanese Firms With Tax-Season Phishing Delivering ValleyRAT

Silver Fox launched a targeted spearphishing campaign against Japanese businesses during tax filing and organizational change season, using localized lures tied to tax compliance violations, salary adjustments, personnel changes, employee stock plans, and invoice themes. Researchers said the actor conducted reconnaissance before sending emails, impersonated real employees and executives, and often inserted the victim company’s name into subject lines to make messages appear legitimate. The emails pushed recipients to open malicious attachments or download archives from public file-sharing services such as gofile[.]io and WeTransfer, with filenames crafted to resemble routine HR, finance, and tax documents.

The campaign delivered ValleyRAT (ESET detection: Win64/Valley), a remote access trojan capable of remote control, persistence, information theft, user monitoring, and potential lateral movement. Separate analysis tied one Japanese-language Rakuten invoice lure to a DLL sideloading chain abusing Dell MaxxAudio, after which the malware beaconed to a Hong Kong-based command-and-control server over port 886; investigators also noted configuration overlaps with Gh0st RAT defaults and fabricated WHOIS data linked to a Chinese registrant email. The activity follows similar seasonal operations seen the previous year and reflects Silver Fox’s broader expansion from earlier Chinese-speaking targets into Japan and other regions.