Silver Fox Suspected in Taiwanese Campaign Using DeepSeek Lure

A China-linked espionage campaign (likely Silver Fox) is distributing fake installers in Chinese that promise popular software and DeepSeek's R1 LLM to trick Taiwanese targets into running payloads. Victims receive legitimate-looking applications but also Sainbox RAT (a Gh0stRAT variant) and sometimes a Hidden rootkit; attackers leverage techniques like BYOVD and DLL sideloading for persistence and privilege escalation, with reported compromises in healthcare, government and industrial environments.