Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via HoldingHands RAT

The Hacker News reports that the threat actors behind Winos 4.0 (also known as ValleyRAT) have expanded their attacks from China and Taiwan to Japan and Malaysia, via a new HoldingHands RAT campaign. Fortinet's FortiGuard Labs notes that the phishing-heavy operation relies on PDFs with embedded malicious links, masquerading as official documents from the Ministry of Finance.

Winos 4.0 is frequently spread through phishing and SEO poisoning, directing users to fake sites for software such as Google Chrome and other apps, with the campaign often attributed to the aggressive Chinese cybercrime group Silver Fox (also tracked as SwimSnake, The Great Thief of Valley, UTG-Q-1000 and Void Arachne).

Fortinet also highlighted a BYOVD-related attack last month that abused a vulnerability driver to disable security software, and Seqrite Labs described Operation Silk Lure using targeted emails with booby-trapped LNK files to drop the Valleyrat payloads. The HoldingHands RAT component gains persistence via a multi-stage infection, can exfiltrate data, run arbitrary commands, and update its C2 address through a Windows Registry entry.