Void Arachne Pushes Winos 4.0 via Trojanized AI, VPN, and Telegram Installers

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

1 linked

Silver Fox

Malware

1 linked

Winos

Affected products

2 linked

Windows InstallerTelegram

Organizations

3 linked

LetsVPNGoogleQuickVPN

Observables

51 linked

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

MD5 hash••••••••••••••••••••••••••••••••Domain••••••••.comSHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

MD5 hash••••••••••••••••••••••••••••••••Domain•••••••••••.ruSHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

MD5 hash••••••••••••••••••••••••••••••••+43

Indicator values are masked on this page. View all 51 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Trendai Security BlogNews · Aug 25, 2026

Behind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C Framework | TrendAI (US)Open source ↗

Mitre AttackNews

Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise | MITRE ATT&CK®Open source ↗

On the same thread

Rapid7 disclosed a targeted malware campaign using a new installer dubbed **CleverSoar** to infect Chinese- and Vietnamese-speaking Windows users with the **Winos4.0** framework, the **Nidhogg** rootkit, and a custom backdoor. The installer performs extensive anti-analysis and targeting checks before execution, including VM and debugger detection, sandbox-user validation, and **system language discovery** consistent with MITRE ATT&CK `T1614.001`, then escalates privileges, disables security tools, turns off the Windows firewall, installs persistence, and hides artifacts. Rapid7 said the activity appears aligned with a long-running espionage effort focused on surveillance, keystroke logging, data theft, and covert remote control. The findings overlap with Fortinet reporting on malware operations aimed at Chinese-speaking users, including a **Winos4.0** campaign spread through trojanized gaming utilities and a separate **ValleyRAT** intrusion set attributed to the suspected **Silver Fox** group. Fortinet said Winos4.0 is a modular framework rebuilt from **Gh0st RAT** that uses staged loaders, shellcode injection, registry-stored modules, and persistence via Run keys or scheduled tasks, while plugins enabled screenshot capture, document theft, clipboard monitoring, and searches for crypto-wallet browser extensions. Rapid7 assessed with medium confidence that CleverSoar may be linked to the same actor behind Fortinet's ValleyRAT-related activity, citing shared tradecraft such as in-memory execution, anti-VM checks, privilege escalation, and evasion tailored to regional security products.

Nov 6, 2024

Malware Campaigns Using Fake Installers and Multi-Stage Loaders to Steal Credentials and Enable Remote Control

Multiple active malware campaigns are using **trojanized installers** and social engineering—rather than software vulnerabilities—to gain initial access and then deploy credential theft or remote-control capabilities. Intel 471 reported a new Android banking trojan dubbed **FvncBot** targeting Polish mobile banking users by impersonating an *mBank* “security” app; the dropper prompts installation of an additional “Play” component and then abuses **Android Accessibility Services** for persistence and control, enabling **keylogging**, **screen capture**, and hidden **VNC-style remote interaction** to facilitate fraudulent transactions. Separately, Cyderes described an ongoing, large-scale piracy-channel campaign where cracked game installers hide behind a legitimate-looking **Ren’Py** launcher tracked as **RenEngine**, which decrypts and launches subsequent stages and introduces **HijackLoader** via techniques including **DLL side-loading** and module stomping; observed final payloads include **ACR Stealer** (and in some cases **Vidar**) to exfiltrate browser credentials, cookies, and crypto wallet data. Cybereason detailed a different installer-themed operation in Chinese-speaking communities delivering **ValleyRat/Winos 4.0** attributed to **Silver Fox APT**, notable for using the rare **“PoolParty Variant 7”** process injection (abusing Windows I/O completion ports and `ZwSetIoCompletion()` after duplicating a handle from `Explorer.exe`) plus a strengthened watchdog mechanism via injection into `Explorer.exe` and `UserAccountBroker.exe` to maintain persistence.

Feb 6, 2026

Chinese-Speaking Threat Actors Spread Gh0st RAT via Trojanized Software Installers

Multiple security firms reported ongoing campaigns targeting Chinese-speaking Windows users with fake or trojanized installers for popular software, including **Google Chrome**, **Microsoft Teams**, **Surfshark**, **Signal**, **Telegram**, **Zoom**, **DeepSeek**, **Quark Cloud**, and activation tools. The attacks rely on spoofed download sites and malicious `MSI` or `NSIS` packages that decrypt payloads in memory and ultimately deploy remote-access malware tied to the **Gh0st RAT** ecosystem, including modified Gh0st variants and **Atlas RAT**. Researchers linked the activity to Chinese-speaking threat actors including **Dragon Breath** and **Silver Fox**, noting refreshed infrastructure, low detection rates, and lures designed to appear legitimate, in some cases using AI-generated web pages and valid code-signing certificates. The intrusion chains emphasize defense evasion before full payload delivery. Reported techniques include abuse of signed or vulnerable kernel drivers to terminate or disable more than 200 security products, unsigned `WDAC` policies to block Chinese antivirus tools, **Protected Process Light** abuse to corrupt **Microsoft Defender**'s `MsMpEng.exe`, phantom DLL side-loading, thread-pool-based process injection, in-memory reflective loading, and persistence through services, scheduled tasks, and watchdog scripts. Once installed, the malware supports encrypted command-and-control, command execution, keylogging, clipboard theft, active-window logging, RDP session hijacking, and additional payload delivery, underscoring a sustained pattern of installer-based malware operations aimed at users seeking trusted software from unofficial sources.

Apr 22, 2026

Void Arachne Pushes Winos 4.0 via Trojanized AI, VPN, and Telegram Installers

How this story unfolded

Trend Micro names new threat actor Void Arachne

Void Arachne campaign discovered targeting Chinese-speaking users

Related entities

Threat actors

Malware

Affected products

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Void Arachne Pushes Winos 4.0 via Trojanized AI, VPN, and Telegram Installers

How this story unfolded

Trend Micro names new threat actor Void Arachne

Void Arachne campaign discovered targeting Chinese-speaking users

Related entities

Threat actors

Malware

Affected products

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Void Arachne Pushes Winos 4.0 via Trojanized AI, VPN, and Telegram Installers

How this story unfolded

Trend Micro names new threat actor Void Arachne

Void Arachne campaign discovered targeting Chinese-speaking users

Related entities

Threat actors

Malware

Affected products

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

CleverSoar and Winos4.0 Campaigns Target Chinese and Vietnamese Windows Users

Malware Campaigns Using Fake Installers and Multi-Stage Loaders to Steal Credentials and Enable Remote Control

Chinese-Speaking Threat Actors Spread Gh0st RAT via Trojanized Software Installers

Void Arachne Pushes Winos 4.0 via Trojanized AI, VPN, and Telegram Installers

How this story unfolded

Trend Micro names new threat actor Void Arachne

Void Arachne campaign discovered targeting Chinese-speaking users

Related entities

Threat actors

Malware

Affected products

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

CleverSoar and Winos4.0 Campaigns Target Chinese and Vietnamese Windows Users

Malware Campaigns Using Fake Installers and Multi-Stage Loaders to Steal Credentials and Enable Remote Control

Chinese-Speaking Threat Actors Spread Gh0st RAT via Trojanized Software Installers