Loading story…
The Chinese cybercrime group Silver Fox is using typosquatted domains that mimic trusted software brands, including Surfshark VPN, Signal, Telegram, Zoom, and Autodesk, to trick Chinese-speaking users into downloading ZIP archives containing trojanized installers. Researchers said the installers deploy a malicious Autodesk binary that loads shellcode, retrieves command-and-control details, and pulls the newly documented AtlasCross RAT into memory from bifa668[.]com over TCP port 9899, marking a shift from the group’s earlier Gh0st RAT-based tools such as ValleyRAT and Winos 4.0.
AtlasCross RAT includes defense-evasion and post-compromise features such as AMSI and ETW bypasses, ChaCha20-encrypted C2 traffic, embedded PowerChell execution, DLL injection, RDP session hijacking, WeChat DLL injection, and disruption of Chinese security products. Reporting from multiple security firms indicates Silver Fox is conducting both broad cybercrime activity and more targeted intrusions across Asia, with victims and targeting tied to Taiwan, India, Japan, and Southeast Asia, while reuse of a stolen code-signing certificate suggests an effort to make payloads appear legitimate and improve evasion for data theft and financial fraud operations.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Breakglass Intelligence reported that a suspected Silver Fox / APT-Q-27 infrastructure cluster, including jackadmin and jackbank panel domains, was registered using the name 罗泉 (Luo Quan) and the email ylfwq002@gmail.com, describing it as an operational security failure. The analysis also linked the cluster to Alibaba Cloud Hong Kong hosting and a large SEO-poisoning lure network, while assessing only medium confidence that Luo Quan is the operator's real-world identity.
A weaponized MSI masquerading as a Telegram Chinese language pack was reported on MalwareBazaar on 2026-04-08, delivering ValleyRAT through a multi-stage chain that used ZPAQ archives, a legitimate ByteDance binary for conditional DLL sideloading, and a kernel-mode rootkit/BYOVD technique. Researchers linked the tooling, infrastructure, lure theme, and AV-evasion logic to Silver Fox despite the campaign using the older ValleyRAT family rather than AtlasCross RAT.
Additional reporting from Knownsec 404, eSentire, Sekoia, and ESET said Silver Fox was conducting both broad cybercrime campaigns and more targeted operations affecting organizations in Taiwan, India, Japan, and several Southeast Asian countries. The campaign also showed operational maturity through reuse of a stolen code-signing certificate across multiple malware efforts.
Hexastrike and other cited researchers described the malware's infection chain, including shellcode loading, retrieval of C2 information, and in-memory download from bifa668[.]com over TCP port 9899. They also documented features such as PowerChell-based AMSI and ETW bypasses, ChaCha20-encrypted C2 traffic, WeChat DLL injection, RDP session hijacking, and disruption of Chinese security products.
An active campaign targeted Chinese-speaking users with fake download sites impersonating brands including Surfshark VPN, Signal, Telegram, Zoom, and Autodesk-related software delivery themes. Victims were lured into downloading ZIP installers containing trojanized binaries that ultimately loaded AtlasCross RAT in memory.
Reporting indicates the Silver Fox cybercrime group evolved from prior Gh0st RAT-based malware such as ValleyRAT and Winos 4.0 to a newly documented malware family called AtlasCross RAT, reflecting a more mature toolset for theft and fraud operations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 64 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence linked multiple March and April malware waves to the **SilverFox** threat actor, describing a broad Chinese-language campaign built around **ValleyRAT** on the `Winos4.0` framework and supported by **Gh0stRAT** and **RustyStealer**. The operation used emotionally charged lures tied to layoffs, disciplinary notices, scam-compound violence, banking fraud, censorship-bypass tools, fake utilities, and business apps, with delivery through WinRAR self-extracting archives, MSI and ZIP packages, DLL sideloading, process hollowing, and staged downloads. One ValleyRAT chain disguised itself as a WeChat-related document, extracted files into `C:\WeChat\`, launched a legitimate WeChat binary as a decoy, and then decrypted and injected the payload while applying Chinese-locale geofencing, anti-VM, and anti-debug checks. Researchers said the malware families provided complementary functions including remote access, keylogging, screenshot capture, clipboard hijacking, credential theft, and persistence, and that targeting extended from mainland Chinese users to diaspora communities, Taiwanese organizations, and some healthcare entities in North America. The infrastructure behind the campaign scaled rapidly, with reporting tying the activity to **22 to 75 command-and-control endpoints** and more than 17 domains across Alibaba Cloud, Tencent Cloud, AWS Hong Kong, Vultr, Azure, Huawei Cloud, and other providers, with Hong Kong serving as a major hub. Analysts connected the clusters through shared protocol behavior, mutexes, ValleyRAT DLL exports, recurring registrar patterns, use of the `codemark` builder variant, and repeated OPSEC failures including exposed RDP services, self-signed certificates, Python SimpleHTTP payload hosting, a Windows host identified as `TEDDY2012`, and domain registration details that appeared to expose operator identity. Separate reporting also described a related **Gh0stRAT/Farfli** "WisemanSupport" campaign using TCP/6658 and hardcoded infrastructure, reinforcing the continued use of Chinese-nexus RAT tooling and overlapping tradecraft in active intrusion operations.
Jun 29, 2026
Microsoft Defender Experts tracked a deceptive software-download campaign using counterfeit vendor websites and dynamically generated malicious installer archives to compromise victims. The activity primarily targeted China-based operations of multinational organizations and Chinese-speaking users in healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assessed with moderate confidence that the operation is consistent with the publicly reported **Silver Fox** (also known as **Yinhu**) threat activity, while stopping short of nation-state attribution. The malware established persistence through scheduled tasks, abused `msiexec` and a repurposed TrueUpdate runtime, weakened Microsoft Defender and Windows Update protections, deleted shadow copies, injected into processes, and communicated with attacker infrastructure through non-standard ports and Alibaba Cloud OSS. Microsoft Defender detected and disrupted elements of the operation, including command-and-control traffic, attempted SMB lateral movement, and hands-on-keyboard activity; however, incident responders still needed to remove the attackers' persistence mechanisms.
Sep 4, 2026
Silver Fox launched a targeted spearphishing campaign against Japanese businesses during tax filing and organizational change season, using localized lures tied to tax compliance violations, salary adjustments, personnel changes, employee stock plans, and invoice themes. Researchers said the actor conducted reconnaissance before sending emails, impersonated real employees and executives, and often inserted the victim company’s name into subject lines to make messages appear legitimate. The emails pushed recipients to open malicious attachments or download archives from public file-sharing services such as gofile[.]io and WeTransfer, with filenames crafted to resemble routine HR, finance, and tax documents. The campaign delivered **ValleyRAT** (ESET detection: `Win64/Valley`), a remote access trojan capable of remote control, persistence, information theft, user monitoring, and potential lateral movement. Separate analysis tied one Japanese-language Rakuten invoice lure to a DLL sideloading chain abusing Dell MaxxAudio, after which the malware beaconed to a Hong Kong-based command-and-control server over port `886`; investigators also noted configuration overlaps with **Gh0st RAT** defaults and fabricated WHOIS data linked to a Chinese registrant email. The activity follows similar seasonal operations seen the previous year and reflects Silver Fox’s broader expansion from earlier Chinese-speaking targets into Japan and other regions.
Jun 29, 2026