Silver Fox: The Only Tax Audit Where the Fine Print Installs Malware

### Executive Summary The report describes 'Silver Fox', a China-based intrusion set that combines financially motivated and APT-style espionage activity across South Asia (China, Taiwan, Japan, Malaysia, Philippines, Thailand, Indonesia, Singapore, India). It documents three campaign waves (tax-themed phishing delivering ValleyRAT via malicious PDFs, an RMM-based second wave, and a compiled Python stealer for credential theft), highlights advanced TTPs such as kernel-mode rootkits and signed-driver abuse, and provides comprehensive IoCs (domains, IPs, file hashes) to support detection and hunting.