Silver Fox Expands Tax-Themed Campaigns with RMM Abuse and Python Stealer
Summary
SEKOIA’s TDR tracks Silver Fox campaigns across South Asia from 2025–2026, detailing tax-themed phishing, ValleyRAT delivery, abuse of a misconfigured Chinese RMM tool, and a WhatsApp-themed Python stealer. It assesses mixed espionage and profit motives.
Key points
- TDR describes Silver Fox as pursuing financially motivated campaigns alongside APT-style operations; the group’s objectives remain uncertain.
- The report identifies three campaign waves: tax-themed PDFs delivering ValleyRAT, phishing that delivers a misconfigured Chinese RMM tool, and a compiled Python stealer disguised as WhatsApp.
- In the first wave, a clickable area in a malicious PDF triggered a ZIP download; a DLL then helped execute ValleyRAT.
- The RMM campaign passed C2 parameters through the executable filename by exploiting a configuration-handling flaw. TDR says evidence was insufficient to establish whether identified C2 addresses remained operational or were exclusively used by Silver Fox.
- The WhatsApp-themed stealer collected device artifacts and uploaded them to xqwmwru[.]top; identified host artifacts include WhatsAppData.zip and whatsapp_backup.lock.
- Silver Fox continued using ValleyRAT after its builder leaked in March 2025. The report also describes use of the HoldingHands Gh0st RAT variant and a Microsoft-signed driver, amsdk.sys, to bypass the Vulnerable Driver Blocklist.
- The campaigns targeted organizations and users in China, Taiwan, Japan, and countries across South and Southeast Asia, using tax and payroll lures.
Article Details
- Attack Vectors
- Tax-themed phishing emails impersonated national tax authorities or payroll communications and delivered either malicious PDF attachments or links to fake tax websites.
- A PDF annotation hid a clickable area that triggered a second-stage ZIP download; the archive contained python311.dll and an executable, with DLL side-loading used to launch ValleyRAT.
- Fake tax websites served ZIP or RAR archives containing a legitimate Chinese RMM executable. Silver Fox reportedly exploited the tool's configuration-handling misconfiguration, placing C2 parameters in the executable filename.
- A compiled Python stealer masqueraded as a WhatsApp application, collected artifacts from infected devices, and uploaded them to its C2.
- SEO poisoning involving gaming- or AI-related applications and fake VPN software, along with malicious ads or Telegram, was reported as a means of directing users toward payloads.
- The article reports abuse of the Microsoft-signed amsdk.sys driver to bypass the Vulnerable Driver Blocklist and use of kernel-mode rootkits for stealth and persistence.
- Defensive Notes
- The article recommends using the RMM-associated IPv4 indicators for hunting or retro-hunting, but cautions that available evidence does not establish whether they remain operational or were used exclusively by Silver Fox operators.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | googlevip[.]icu | Listed as a phishing website used by Silver Fox. |
| DOMAIN | gov[.]incometax[.]click | Listed as a phishing website used by Silver Fox. |
| DOMAIN | oytdwzz[.]shop | Listed as a phishing website used by Silver Fox. |
| IPV4 | 154[.]201[.]87[.]124 | IP address hosting the fake WhatsApp stealer C2, in the same address block as the phishing website. |
| IPV4 | 154[.]201[.]87[.]75 | IP address hosting a phishing website that delivered the payload. |
| SHA256 | 055c3fff8f1f58a41e7571b9bd7ebf4b1b10ba5231f1ffbcb47e0307d7ff6072 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | 06ecf34ecf1f3f56a1760b8757b978d6bd859adcf699af4adfbeb0982e41282a | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | 18cb036bcc7aacf7393575ddf15133e24d3a22cc92a4b14e8595686e4bf80629 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | 249d2d1d6cfcf34d48ac0465ede688759a3c90b7412723373ea5a434d6d64c9c | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | 2a4eab726a878a74dcad41d090681a7fa78d9247b1812e5c3066d7a1aa0413b1 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | 316cbc90ad71a421e571b529af2dee40f901b15b4bc549836c25f1be35597249 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | 36e0368dd4c3c9c70a78050618797705cda87a017e41777968c6b4b9173f553f | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | 3f8e2ef8a5e7b8f8d14e43032ad2b18f0a4fb168609494fd346dcdfe1127a5cd | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | 616be8ba3383909b2b04c87bcb9ca0707f5a19a8eaa6fc1e552181baa4e3e0aa | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | 75bf89f0369b6eef1e2931e6da67a9d4f3095b9a623e6e8fdddf7fee66cc7cc0 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | 80f7f10bcddafaec497a2de78dd3d2a53b72f27bb72e7939443539115f7e2168 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | 8c54e6d91d95885beae125b30ab9096bd341e12be08dec3aeb859e539dc77d47 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | 98be97a6f4663d04cf5382f4ed046b479af1dd300d0ab3fa7a399ab15078d7a0 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | a6fd51bf2da2c2544ff78ef1824c30d4feef9a77c824f36d9afd2c6093c9b6ae | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | a8d193e49e6c9c6d7c32ea807d22311bd1b110f2326b8a96c67978ecc6862ee6 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | a8edb8fb1cf83031a454b5f39ffab0b1d93448cb3b9794246507e35ba0036801 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | ae243178e201c6ee475e4498cade0d21ef22b8a6923322576115b0888e189013 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | aed5ce23aa11f28e063c8b1b0836d3dbd059d93867e8e828a8356770ee185d1b | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | d49bd211364594c671c4e34a31afb75becc69b32b45b140ed0d200f4b05868c6 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | d91ea2ec158e871408229ec2f7a8fe78a8d30ed0db42f73fe9e31875b30b17c2 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | eb4a53145734d1ef612897337b1fc3375209598c427590731bb87de3bd8f9bb0 | Hash of an archive identified as dropping the RMM tool. |
| SHA256 | fc43d1640d94ef621c82a4a3d0406df3443b39043c4ddef0a23608c186c307e8 | Hash of an archive identified as dropping the RMM tool. |
| URL | hxxps[:]//xqwmwru[.]top/admin/login.php | Login panel on the Python stealer's C2 server. |
| URL | hxxps[:]//xqwmwru[.]top/upload_large.php | Python stealer C2 endpoint identified for data exfiltration. |
| URL | hxxps[:]//xqwmwru[.]top/upload_status.php | Python stealer C2 endpoint identified for data exfiltration. |
MITRE ATT&CK
T1014 · RootkitThe article reports kernel-mode rootkit use for persistence and stealth.T1036 · MasqueradingThe compiled Python stealer was disguised as a WhatsApp application.T1041 · Exfiltration Over C2 ChannelThe Python stealer uploaded collected artifacts to its C2 endpoints.T1105 · Ingress Tool TransferOpening the malicious PDF triggered a second-stage ZIP download from myqcloud infrastructure.T1189 · Drive-by CompromiseThe article reports SEO poisoning involving gaming- or AI-related applications and fake VPN software to direct users toward payloads.T1566.001 · Spearphishing AttachmentPhishing emails impersonating tax authorities delivered malicious PDF attachments that initiated the infection chain.T1566.002 · Spearphishing LinkPhishing emails embedded links to fake tax websites that prompted victims to download archives or executables.T1574.002 · DLL Side-LoadingDLL side-loading was used in the PDF-delivered infection chain to execute ValleyRAT.
Threat Actors
Malware
BlackmoonThese operations typically leverage ubiquitous malware from the Chinese cybercrime ecosystem, such as Blackmoon.Gh0st RATIn addition, Silver Fox relies on other malicious payloads like HoldingHands, which is a variant of Gh0st RAT.HoldingHandsSince early 2025, China-based intrusion set Silver Fox has combined APT-style operations (using modular backdoors like ValleyRAT and HoldingHands) with opportunistic financially motivated campaigns across South Asia.NidhoggThe evolution of its arsenal, including CleverSoar installer and Nidhogg rootkit, suggested this intrusion set engaged in a more advanced post-exploitation toolkit likely to conduct espionage along with lucrativeValleyRATSince early 2025, China-based intrusion set Silver Fox has combined APT-style operations (using modular backdoors like ValleyRAT and HoldingHands) with opportunistic financially motivated campaigns across South Asia.winosThe group’s primary modular backdoor is ValleyRAT (aka Winos); despite the ValleyRAT builder leak in March 2025, Silver Fox continued to use and extend it with sophisticated plugins and kernel-mode components.
Vendors
Products
Countries
ChinaSince early 2025, China-based intrusion set Silver Fox has combined APT-style operations (using modular backdoors like ValleyRAT and HoldingHands) with opportunistic financially motivated campaigns across South Asia.IndiaCampaigns used culturally relevant tax/payroll lures and SEO poisoning to broaden victimology across Taiwan, China, Japan, Malaysia, Indonesia, Singapore, Thailand, the Philippines, and India.IndonesiaCampaigns used culturally relevant tax/payroll lures and SEO poisoning to broaden victimology across Taiwan, China, Japan, Malaysia, Indonesia, Singapore, Thailand, the Philippines, and India.JapanCampaigns used culturally relevant tax/payroll lures and SEO poisoning to broaden victimology across Taiwan, China, Japan, Malaysia, Indonesia, Singapore, Thailand, the Philippines, and India.MalaysiaCampaigns used culturally relevant tax/payroll lures and SEO poisoning to broaden victimology across Taiwan, China, Japan, Malaysia, Indonesia, Singapore, Thailand, the Philippines, and India.PhilippinesCampaigns used culturally relevant tax/payroll lures and SEO poisoning to broaden victimology across Taiwan, China, Japan, Malaysia, Indonesia, Singapore, Thailand, the Philippines, and India.SingaporeCampaigns used culturally relevant tax/payroll lures and SEO poisoning to broaden victimology across Taiwan, China, Japan, Malaysia, Indonesia, Singapore, Thailand, the Philippines, and India.TaiwanCampaigns used culturally relevant tax/payroll lures and SEO poisoning to broaden victimology across Taiwan, China, Japan, Malaysia, Indonesia, Singapore, Thailand, the Philippines, and India.ThailandCampaigns used culturally relevant tax/payroll lures and SEO poisoning to broaden victimology across Taiwan, China, Japan, Malaysia, Indonesia, Singapore, Thailand, the Philippines, and India.