Full Report
The threat actor known as Silver Fox has been spotted orchestrating a false flag operation to mimic a Russian threat group in attacks targeting organizations in China. The search engine optimization (SEO) poisoning campaign leverages Microsoft Teams lures to trick unsuspecting users into downloading a malicious setup file that leads to the deployment of ValleyRAT (Winos 4.0), a known malware
Analysis Summary
# Threat Actor: Silver Fox
## Attribution & Identity
* **Primary Identifier:** Silver Fox
* **Known Associations:** Associated with the deployment of ValleyRAT (Winos 4.0), a malware primarily attributed to Chinese hacking groups.
* **Distinctive Strategy:** Currently engaging in a **false flag operation** intended to mimic a Russian threat group to mislead attribution.
## Activity Summary
* **Recent Campaign:** An ongoing SEO poisoning campaign active since November 2025.
* **Operation Goal:** To execute a false flag operation specifically targeting Chinese-speaking users, including those within Western organizations operating in China, by utilizing Cyrillic elements and misattribution tactics.
## Tactics, Techniques & Procedures
* **Infection Vector:** Search Engine Optimization (SEO) poisoning combined with lures impersonating legitimate software (Microsoft Teams).
* **Initial Access:** Directing users via SEO poisoning to a bogus website leading to the download of a malicious ZIP file named "MSTчamsSetup.zip" from an Alibaba Cloud URL.
* **Masquerading/Evasion:** The ZIP archive utilizes Russian linguistic elements to confuse attribution efforts.
* **Execution/Defense Evasion:**
* Trojanized "Setup.exe" scans for and targets security binaries (e.g., "360tray.exe" related to 360 Total Security).
* Configuring exclusions for Microsoft Defender Antivirus.
* Writing and executing "Verifier.exe" (a trojanized Microsoft installer) from `AppData\Local\`.
* Establishing persistence and evasion by utilizing file dropping (`Profiler.json`, `GPUCache2.xml`, etc.) and loading malicious DLLs into the memory of a legitimate process (`rundll32.exe`).
* **Secondary Techniques (Observed in related ValleyRAT chains, potentially applicable):**
* Bring Your Own Vulnerable Driver (BYOVD) technique to load "NSecKrnl64.sys" and terminate security solution processes.
* Staging password-protected archives and using a renamed 7-Zip binary for extraction.
* Setting up persistence via a scheduled task that executes an encoded VBE script.
* **MITRE ATT&CK IDs:** (Not explicitly mentioned in the context, but techniques overlap with **T1566.002** (Phishing: Spearphishing Link) and **T1574.002** (Hijack Execution Flow: DLL Side-Loading) and **T1055** (Process Injection)).
## Targeting
* **Sectors:** Organizations targeted within China (sector information is broad, risk profile suggests sensitive entities).
* **Geography:** Organizations in **China**.
* **Victims:** Chinese-speaking users, including those within Western organizations operating in China.
## Tools & Infrastructure
* **Malware Families Used:**
* ValleyRAT (Winos 4.0) - Used as the final payload.
* ValleyRAT loader (modified).
* `men.exe` (second-stage orchestrator in related chains).
* **Infrastructure:** Alibaba Cloud URL used to host the initial ZIP file.
* **C2/Exfiltration:** Establishes a connection to an external server to fetch the final payload.
## Implications
Silver Fox aims for dual objectives: **financial gain** (theft, scams, fraud) and **intelligence collection** for geopolitical advantage. The use of a sophisticated false flag operation involving Russian linguistic elements severely complicates attribution efforts, allowing the actor to operate with plausible deniability, leveraging known Chinese-linked malware (ValleyRAT). Targets face immediate risks including data breaches, financial losses, and long-term network compromise.
## Mitigations
* Heightened vigilance against SEO poisoning results for popular software.
* Scrutinize downloads originating from unexpected or suspicious cloud storage links, even when purporting to be legitimate software updates (e.g., Microsoft Teams).
* Monitor for configurations related to Microsoft Defender Antivirus exclusions being set during routine operations.
* Implement strong endpoint detection and response (EDR) capable of detecting process injection tactics (*rundll32.exe* memory loading) and termination of security processes.
* Monitor for suspicious scheduled tasks or driver loading activity (especially BYOVD techniques).