China's Silver Fox spoofs medical imaging apps to hijack patients' computers

Forescout Vedere Labs found a China-linked APT (Silver Fox) distributing trojanized Philips DICOM viewers and other utilities to infect patient devices with ValleyRAT, a keylogger, and a cryptominer. Samples collected between July 2024 and January 2025 show PowerShell-based evasion, AV termination (TrueSightKiller), use of Alibaba Cloud buckets to host encrypted payloads, and C2 infrastructure activity; accessible cloud buckets and evidence of English-language and US/Canada submissions suggest expanding targeting beyond Chinese-speaking victims, posing a risk to healthcare environments and patient-owned devices.