Silver Fox: The only Tax Audit Where Fine Print Installs Malware

TDR documents Silver Fox, a China-linked intrusion set that combines APT-style espionage and profit-driven cybercrime across 2025–2026: using modular backdoors (ValleyRAT), HoldingHands (Gh0st variant), kernel‑level rootkit techniques, tax-themed phishing lures, and evolving delivery mechanisms (PDF DLL side‑loading, abused RMM binaries, and a compiled Python stealer) in three campaign waves targeting Taiwan and multiple South Asian countries; the report includes extensive IoCs (domains, IPs, hashes, C2 endpoints) and analysis of the group's dual objectives and evolving TTPs.