45
45
45
45
45
45
45
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.
Microsoft Defender Experts is tracking an active campaign using spoofed software download sites for brands such as Razer, Kaspersky, Microsoft Edge, Calibre, and Baidu Netdisk on .com.cn and .hl.cn domains, delivering installer archives whose hashes change per download, indicating server-side payload generation. The implants establish persistence, weaken security protections, and communicate with attacker-controlled infrastructure, with confirmed compromises across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence that the activity matches the publicly reported Silver Fox (Yinhu) fake software campaign; it has not attributed it to a nation-state actor.
63
45
45
45
60
45
SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia
Hunt.io links SpiceRAT C2 servers to China-nexus SilkParasite espionage targeting Central Asian governments, with related infrastructure active since 2022.
Hunt.io and researcher Guy Yasur traced a cluster of SpiceRAT command-and-control servers active from late 2025 to August 2026 to infrastructure linked to the China-nexus SilkParasite espionage operation. Shared parent domains, a certificate resembling an Uzbek railway entity, and a cloned RTX Corporation homepage appearing on 13 servers connect SpiceRAT systems to NodeEdgeRAT and NomadRAT infrastructure. Passive DNS records show related subdomains as early as mid-2022, suggesting the infrastructure has existed for at least four years. Hostnames impersonate government, energy and telecom targets across Turkmenistan, Tajikistan, Uzbekistan, Kyrgyzstan and Kazakhstan.
60
45
45
45
60
45
45
45
45
45
45
57
SilkParasite Hackers Use SpiceRAT Infrastructure to Target Central Asian Governments and Energy Firmsnew
Hunt.io links SpiceRAT C2 infrastructure to the China-nexus SilkParasite espionage cluster targeting Central Asian governments, telecoms, and energy firms.
Hunt.io analysis expanded the SpiceRAT command-and-control footprint tied to SilkParasite, a China-nexus espionage cluster (medium confidence per Bitdefender) targeting government, telecommunications, and energy entities across Central Asia. Five active servers coordinated from mid-March 2026 were clustered via reused hostnames, TLS certificates, and a byte-identical clone of RTX Corporation's webpage found on 13 IPs; a certificate for azure.uzrailwaystax[.]com appeared across eight servers. Domains impersonated Türkmengaz, Tojiktelecom, Turkmenistan's Foreign Ministry, and Uzbek and Kyrgyz bodies, with passive DNS history dating to mid-2022. Impersonated organizations were not confirmed as compromised; Cisco Talos previously linked SpiceRAT to SneakyChef's LNK/HTA infection chains.
55
New Malware 'Rover' Targets Indian Ambassador to Afghanistan
Unit 42 reports a spearphishing attack delivering the custom Rover Trojan to India's Ambassador to Afghanistan, exploiting CVE-2010-3333 in Word.
On December 24, 2015, Unit 42 identified a targeted spearphishing email spoofing Indian Defence Minister Manohar Parrikar, sent to India's Ambassador to Afghanistan. The RTF attachment exploited CVE-2010-3333 in Microsoft Word to download a downloader from newsumbrella.net, which retrieved the Rover Trojan and DLL plugins from 46.166.165.254. Rover uses OpenCV for webcam capture, OpenAL for audio recording and libsndfile for audio files, with data exfiltration over its C2 channel; separate payload versions target Windows XP and later systems.
40
60
60
45
45
45
60
57
45
45
45
60
57
57