Silver Fox Phishing Campaign Delivers ValleyRAT and New ABCDoor Backdoor

The China-linked threat group Silver Fox ran a phishing campaign that impersonated tax authorities in India and Russia to infect organizations with ValleyRAT and a newly documented Python backdoor, ABCDoor. Researchers said the activity began with fake tax notices sent as PDF attachments that directed victims to download a malicious archive. That archive contained a modified Rust-based loader, RustSL, which used geofencing, environment checks, stealth features, and persistence mechanisms before deploying ValleyRAT and then ABCDoor. More than 1,600 malicious emails were observed between early January and early February 2026, with victims spanning the industrial, consulting, retail, and transportation sectors.

Analysis tied ABCDoor to Silver Fox’s toolkit since at least late 2024, with confirmed operational use starting in early 2025. On infected Windows systems, the malware established persistence through the Run registry key and a scheduled task named AppClient, concealed files under C:\ProgramData\Tailscale, and abused pythonw.exe and ffmpeg.exe to blend in while enabling surveillance, remote interaction, module execution, command-and-control, and data exfiltration. Researchers also identified a new ValleyRAT plugin that acted as a loader for ABCDoor, showing the group is expanding a malware chain built for covert access and follow-on control.