Search: “Silver Fox trojan”

13 stories

Kaspersky details ValleyRAT delivered via trojanized QN Wallpaper using DLL sideloading, tied to Silver Fox and hitting 1,500+ users in China and India.

Kaspersky found a malicious installer abusing a modified version of the legitimate QN Wallpaper adware application to deliver the ValleyRAT backdoor via DLL sideloading of libcef.dll. The installer masquerades as DingTalk, Chrome or Tencent Meeting software, creates persistence, disables Windows Defender via the DisableAntiSpyware registry key, and loads AES-encrypted payloads. ValleyRAT collects keystrokes, clipboard contents and screenshots plus system details, can download additional modules, and resists removal by injecting into svchost.exe or marking its process critical. The campaign was detected over 100,000 times in 2026, affecting more than 1,500 users mainly in China and India, and is attributed to Silver Fox with both espionage and financial motives.

Security AffairsAug 31, 19:45 UTC · 16d agoMalware in the wild

New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic

The Hacker NewsJul 10, 13:45 UTC · Jul 10, 2026Malware

Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via HoldingHands RAT

The Hacker NewsOct 19, 06:06 UTC · Oct 19, 2025Malware

Fake Google Chrome Sites Distribute ValleyRAT Malware via DLL Hijacking

The Hacker NewsFeb 7, 05:07 UTC · Feb 7, 2025Malware

HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks

The Hacker NewsSep 15, 00:00 UTC · Sep 15, 2025Malware

Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

The Hacker NewsJul 9, 10:22 UTC · Jul 9, 2026Malware

PNGPlug Loader Delivers ValleyRAT Malware Through Fake Software Installers

The Hacker NewsJan 21, 05:45 UTC · Jan 21, 2025Malware

Chinese Group Silver Fox Uses Fake Websites to Deliver Sainbox RAT and Hidden Rootkit

The Hacker NewsJun 27, 15:11 UTC · Jun 27, 2025Malware

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

The Hacker NewsJul 27, 11:38 UTC · Jul 27, 2026Malware

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off

Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.

This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.

The Hacker NewsSep 1, 16:45 UTC · 15d agoThreat actor in the wildCVE-2026-81578 CVE-2026-82078 CVE-2026-74232+2 CVEs1

New Crypter-as-a-Service Cruciferra Fuels Stealthy Malware Attacks Worldwide

Security AffairsJul 28, 09:35 UTC · Jul 28, 2026Malware

Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

Acronis details a Spark RAT campaign against Cambodia abusing the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to disable Microsoft Defender and other security tools.

Acronis TRU analyzed a multi-stage Spark RAT campaign targeting Cambodian individuals and organizations with lures spanning government notices, public health materials, and real estate documents. Attack chains use phishing emails with Inno Setup archives, DLL side-loading via a signed Tencent executable, and BYOVD abuse of the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to terminate security software. Shellcode hidden in PNG files patches AMSI and ETW, establishes scheduled task and service persistence, and injects into vssvc.exe and ctfmon.exe to run the open-source Go-based Spark RAT. Tactics resemble the Silver Fox actor, but Acronis tracks the cluster as unattributed with low confidence.

The Hacker NewsAug 27, 13:22 UTC · 20d agoMalware in the wildCVE-2026-36425

HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures

A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.

ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.

ANY.RUNSep 8, 10:24 UTC · 8d agoMalware in the wild