Silver Fox Uses Weaponized VPN and App Installers to Deliver Atlas RAT

Mar 25, 2026 · Original article ↗

Summary

Researchers detail Silver Fox’s active campaign targeting Chinese-speaking users with trojanized app installers that deploy Atlas RAT, evade security controls, and disrupt security software. The report includes infrastructure and detection guidance.

Key points

Eleven confirmed typosquatted domains impersonated VPN, messaging, video-conferencing, cryptocurrency, and other software brands to distribute malicious installers.
The installers used a triple-nested Setup Factory chain and a stolen EV code-signing certificate to deliver a trojanized Autodesk binary alongside legitimate decoy software.
The loader retrieved shellcode over raw TCP, reflectively loaded Atlas RAT in memory, and contacted bifa668[.]com on port 9899.
Atlas RAT embeds PowerChell, hosting the .NET CLR to run PowerShell while bypassing AMSI, ETW, Constrained Language Mode, and script logging.
The RAT can inject DLLs into WeChat, hijack RDP sessions, establish scheduled-task persistence, and terminate TCP connections used by several Chinese security products.
Researchers identified 20 related RAT DLLs from November 2025 through March 2026, indicating an ongoing campaign; the report provides indicators and hunting recommendations.

Article Details

Attack Vectors: Typosquatted download sites impersonating trusted software brands distribute ZIP archives containing a triple-nested installer and trojanized payloads.
The installer drops a trojanized Autodesk binary that decrypts its embedded configuration and downloads second-stage shellcode over raw TCP from bifa668.com:9899.
A reflective PE loader maps the Atlas RAT DLL into memory; the RAT can also inject an operator-supplied DLL into WeChat.exe.
The RAT hosts PowerShell through the .NET CLR inside its own process and disables AMSI, ETW, Constrained Language Mode, and ScriptBlock logging before executing commands.
The RAT establishes persistence with a scheduled task under MicrosoftWindowsAppID and disrupts security products by terminating their TCP connections.
Defensive Notes: Block the listed delivery domains and C2 infrastructure; investigate outbound TCP connections on port 9899 and the reported SFuck beacon.
Restrict software execution to approved directories, limit administrator privileges, and warn users against downloading applications from unofficial or recently registered domains.
Hunt for the reported staging paths, configuration files, randomized executables under C:\Windows, and the DUC FABULOUS CO.,LTD certificate thumbprint.
Monitor non-PowerShell processes loading System.Management.Automation.dll and investigate the PowerChell AppDomain name.
Audit scheduled task creation under MicrosoftWindowsAppID and unexpected execution of tscon.exe.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`app-zoom[.]com`	Confirmed malicious delivery domain impersonating Zoom.
DOMAIN	`bifa668[.]com`	Atlas RAT C2 domain used for raw TCP communications on port 9899.
DOMAIN	`eyy-eyy[.]com`	Confirmed malicious delivery domain in the campaign.
DOMAIN	`kefubao-pc[.]com`	Confirmed malicious delivery domain impersonating KeFuBao.
DOMAIN	`quickq-quickq[.]com`	Confirmed malicious delivery domain impersonating QuickQ VPN.
DOMAIN	`signal-signal[.]com`	Confirmed malicious delivery domain impersonating Signal.
DOMAIN	`telegrtam[.]com[.]cn`	Confirmed malicious delivery domain impersonating Telegram.
DOMAIN	`trezor-trezor[.]com`	Confirmed malicious delivery domain impersonating Trezor.
DOMAIN	`ultraviewer-cn[.]com`	Confirmed malicious delivery domain impersonating UltraViewer.
DOMAIN	`wwtalk-app[.]com`	Confirmed malicious delivery domain impersonating WangWang.
DOMAIN	`www-surfshark[.]com`	Confirmed malicious delivery domain impersonating Surfshark VPN.
DOMAIN	`www-teams[.]com`	Confirmed malicious delivery domain impersonating Microsoft Teams.
IPV4	`61[.]111[.]250[.]139`	A record for the Atlas RAT C2 domain bifa668.com.
SHA1	`2c1d12f8bbe0827400a8440af74fffa8dcc8097c`	Thumbprint of the stolen DUC FABULOUS CO.,LTD EV certificate used to sign the campaign installers.
SHA256	`02401a2f2de8de15f00d637e555512fe3138c23e24ea1878f2cf2f647cf40b30`	Hash of the malicious campaign delivery archive quickq_setup.zip.
SHA256	`0896f5171a25ab6263598bb501d11413ffbbef05b168ff71b8d54ee9b81103b6`	Hash of the malicious campaign delivery archive zoom_setup.zip.
SHA256	`115a75d0ce595fc92f1acaa8b564c3f391325c34ddf34177c357a00306d6d216`	Hash of the malicious campaign delivery archive UltraViewer_setup_6.6_cn.zip.
SHA256	`1ad1f7d11bb1e6183ce20403ede42e65dba17a6ab660883ea1446ad331d69302`	Hash of the malicious campaign delivery archive MSTeamsSetup.zip.
SHA256	`3372ae716f20eedd3b7d77d08d7010e8424ca5cec781bde4fe3ec76d466cfe8f`	Hash of the malicious campaign delivery archive telegrtam_setup.zip.
SHA256	`42da0ad45bfe9b7f82247d780a32e128e0b00846fe76eea96250e3088f54909b`	Hash listed for a standalone RAT executable from November 2025.
SHA256	`49220c1046014c88720cceaf148ec83e3cd644e61fe339d1217f1a22ccf51614`	Hash of a Setup Factory launcher used in the malicious installer chain.
SHA256	`49ef5e6e6257d082073e000f9a0129f289ed715a288e19cc32344dc054c54ca6`	Hash of the malicious campaign delivery archive signal_setup.zip.
SHA256	`5841ad433ab199bb784a4d33fd629101d22de6e44dce0606c08b92f8b4709380`	Hash of a Setup Factory launcher used in the malicious installer chain.
SHA256	`797e1b6b5c37fec6c7a4629ca2f60b922f2212cf11946ecc23b0ca2faf8e3b99`	Hash of the dropped bifa668.com configuration file containing Atlas RAT C2 settings.
SHA256	`8009908c6c76a72e20e4020a9f9eb9e4d4203507f67a624ecf7f4ed672cf4b68`	Hash of the Atlas RAT DLL identified as SetupUi.dll / MainDll.dll.
SHA256	`817295bf52e243fb8632529133ccd04820d58352efca5928f34c7248c7f1932d`	Hash of the malicious campaign delivery archive wangwang_win_online.zip.
SHA256	`8cecb015075094fe42d613a371480ba5f5813c931eb48eb7b893dac835172b37`	Hash of the shellcode payload captured from the C2 connection.
SHA256	`97f2b246627cc7afe3ed524b63a846e30ee37c81143493ab70c30ee0568dde86`	Hash of the malicious campaign delivery archive eyy-yy2026_setup.zip.
SHA256	`99c0e015c7b8d3df609b370ec3329be55c94797c92c24ec512f6546acdf1e246`	Hash of the malicious campaign delivery archive surfshark_setup.zip.
SHA256	`a481befbec1d49041202331cdbf01a3e9cda8f714b8cbdfb52c676c7a5d7bdf7`	Hash of a Setup Factory launcher used in the malicious installer chain.
SHA256	`d67545f666e89419c0ccd0346929b1906b46eb8b3cff2b94671c6d5755e81f3e`	Hash listed for a standalone RAT executable from November 2025.
SHA256	`e3f04545fb59d2943a4a30cd1b6fa39cb36e1e803301ab2ca5fad2bca84f04dd`	Hash of the malicious campaign delivery archive aicoin_setup.zip.
SHA256	`fa5d3a9eebf9310148e7b980fefa7bc3f3a8e8ee7a8d0bd21a057c54c5a47560`	Hash of Schools.exe, the trojanized loader that retrieves the second-stage payload.
SHA256	`fcc959730c9103d23975bbb41faf84a7f1dd75971f5baff9335bd9a346b0edee`	Hash of the malicious campaign delivery archive KeFuBaoSetup.zip.