Income Tax Phishing Campaigns Linked to Silver Fox Hackers Target Indian Organizations

CloudSEK TRIAD reports an active Silver Fox APT campaign targeting Indian organizations with income tax–themed phishing that lures victims to a malicious NSIS installer (tax affairs.exe) which drops a signed Thunder.exe and a malicious libexpat.dll to perform DLL hijacking; the chain decrypts and loads an in-memory payload (DonutLoader) that deploys Valley RAT, a remote access Trojan with keylogging, credential theft, registry-based plugin persistence, and multi-tier C2 domains (e.g., b.yuxuanow.top, itdd.club, gov-a.work).