Silver Fox APT Leverages Weaponized Medical Software to Deploy RATs and Disable AV

Silver Fox (aka Void Arachne) is described as a Chinese state-sponsored APT active since 2024 that uses a trojanized Philips DICOM MediaViewerLauncher.exe to deliver a multi-stage attack: encrypted payloads retrieved from Alibaba Cloud OSS install loaders which use PowerShell Defender exclusions, scheduled tasks, and a signed but vulnerable driver (189atohci.sys) to achieve persistence and AV/EDR suppression; subsequent modules include ValleyRAT (RAT), a keylogger (credential theft), and a Monero miner, targeting healthcare, government, and critical infrastructure.