Fake Tax Audits and Updates Fuel Silver Fox Malware Campaign

Silver Fox, a China-linked threat actor active since at least 2022, is conducting targeted campaigns across Taiwan, Japan and multiple Southeast Asian countries using spear-phishing, fake tax audit notices, trojanized installers via SEO-poisoned sites, and fake software pages to deliver loaders and RATs. The group employs BYOVD (signed but vulnerable drivers) to disable endpoint security, deploys a diverse toolkit (AtlasCross RAT, ValleyRAT, Gh0st variants, PNGPlug/Catena loaders, a Python-based data stealer), and exfiltrates sensitive data from organizations in healthcare, finance, and enterprise sectors.