DMZ//THREAT INTEL
FEED ACTIVELAST SYNC: 13:15:29ZSOURCES: 14CRITICAL: 18
⚠ ACTIVE ALERTS
@GossiTheDog CRITICAL — wp2shell (CVE-2026-63030 + CVE-2026-60137) is being actively exploited in the wild —… /// @MsftSecIntel CRITICAL — Microsoft is tracking active exploitation of CVE-2026-63030 and CVE-2026-60137… /// @vxunderground CRITICAL — wp2shell PoCs are now floating around the internet. Public exploit code for the full… /// @FalconFeedsio CRITICAL — 🔴 Qilin ransomware group has now publicly claimed 2,035+ victims on its dark web leak… /// @TalosSecurity CRITICAL — Talos is tracking mass exploitation of wp2shell (CVE-2026-63030/CVE-2026-60137).…
18Critical Threats
18Active CVEs
10IOCs Tracked
6New Advisories
INTEL FEED/THREAT ACTORS/SILVER FOX
TLP:WHITETHREAT ACTOR DOSSIER // SILVER-FOX-APTFIRST SEEN: 2023

SILVER FOX

ALSO KNOWN AS: Monarch, SwimSnake, The Great Thief of Valley, UTG-Q-1000, Void Arachne
FROM:DMZ INTELLIGENCE DESK
ORIGIN:China (cybercrime nexus with suspected state alignment)
ATTRIBUTION:STATE-SPONSORED
STATUS:● ACTIVE
FIRST OBSERVED:2023
TECHNICALRESOURCESPERSISTENCESTEALTHIMPACT
TECHNICAL76/100
RESOURCES84/100
PERSISTENCE84/100
STEALTH84/100
IMPACT76/100

SUBJECT PROFILE

Silver Fox is a China-linked APT group newly documented by Kaspersky (May 2026) as having significantly expanded its geographic targeting to include Russia and India, using tax-authority impersonation phishing to deploy a newly discovered Python-based backdoor called ABCDoor alongside the established ValleyRAT (Winos 4.0) RAT. The group's technical maturity is growing: ABCDoor features visual remote control via FFmpeg screen-broadcasting, DPAPI-encrypted persistence, and self-updating/self-deletion logic — distinct from traditional shell-based RATs. Over 1,600 malicious emails were recorded in a single month-long period in early 2026.

Espionage, credential theft, persistent network access across industrial and financial sectors

OPERATIONAL HISTORY

T1566 (Spearphishing - tax authority impersonation), T1027 (Obfuscated Files - Cython-compiled Python, RustSL loader), T1547 (Boot/Logon Autostart - Registry Run keys + scheduled tasks), T1055 (Process Injection - pythonw.exe masquerade), T1056 (Input Capture - keyboard/mouse emulation), T1113 (Screen Capture - FFmpeg Desktop Duplication API), T1115 (Clipboard Theft), T1041 (Exfiltration over C2 - asyncio/Socket.IO HTTPS), T1036 (Masquerading - Tailscale VPN directory mimicry), T1071 (Application Layer Protocol), T1485 (Data Destruction - self-deletion), T1195 (Supply Chain - modified open-source RustSL loader), T1497 (Virtualization/Sandbox Evasion - geofencing checks)

INDUSTRIAL
CONSULTING
RETAIL
TRANSPORTATION
FINANCIAL SERVICES
GOVERNMENT

KNOWN INFRASTRUCTURE

ValleyRAT (Winos 4.0) C2 infrastructure, ABCDoor C2 via 'abc' subdomain HTTPS channels, modified RustSL open-source shellcode loader, self-extracting RAR/ZIP delivery archives, multi-stage segmented C2 using separate addresses per attack phase, 'Phantom Persistence' technique hijacking Windows shutdown APIs

ATTRIBUTED CAMPAIGNS

FILE DATE: DEC 2025
Operation Tax Trap - India Wave
Silver Fox sends phishing emails impersonating India's Income Tax Department, delivering RustSL loader that deploys ValleyRAT and newly documented ABCDoor backdoor against industrial, consulting, and transportation organizations.
FILE DATE: JAN 2026
Operation Tax Trap - Russia Expansion
Nearly identical campaign pivots to Russian organizations impersonating Russian tax authorities; ████████████████████ emails logged in Jan–Feb 2026 with Japan added to supported country geofencing list, signaling further geographic expansion.
SHARE BRIEF:✕ Post on Xin Share on LinkedIn