Silver Fox Campaign Deploys ValleyRAT Through Tax-Themed Lures

Between late 2025 and early 2026 the Silver Fox APT ran a multi-stage, tax-themed phishing campaign against organizations in India and Russia that used a custom Rust loader (RustSL) to load ValleyRAT and a newly identified ABCDoor backdoor (which streams the victim's screen via ffmpeg and enables remote control and data theft). The report details delivery variations (RAR-embedded executables, PDFs with external links), registry persistence, auxiliary plugins delivering a Python environment and ABCDoor, and recommends enhancing endpoint detection, monitoring unusual Python activity, and strengthening phishing defenses.