Skip to content
OriginalSign in
Image: dti.domaintools.com

dti.domaintools.comdti.domaintools.com

DomainTools Uncovers Russia’s Secret Cyber Training Programmes

Part of the Void Arachne story · since 28 Aug 2025

Quiet for 6 weekslast report 18 Sep27 articles10 outlets
28 Aug · Check Point first31 Mar12 Jun24 AugNowThis article27th of 27
  • Thu 28 Aug, 14:45 UTC. Check Point, first report. Chasing the Silver Fox: Cat & Mouse in Kernel Shadows.
  • Fri 29 Aug, 08:00 UTC. GBHackers, its first report on the story. Silver Fox Hackers Use Driver Vulnerability to Evade Security on Windows Systems.
  • Mon 1 Sep, 02:15 UTC. SecurityOnline, its first report on the story. Silver Fox APT Exploits Microsoft-Signed Driver to Deploy ValleyRAT Backdoor.
  • Tue 2 Sep, 10:15 UTC. The Hacker News, its first report on the story. Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware.
  • Sat 18 Oct, 07:15 UTC. The Hacker News. Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via HoldingHands RAT.
  • Thu 4 Dec, 17:55 UTC. The Hacker News. Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China.
  • Tue 9 Dec, 01:30 UTC. SecurityOnline. Silver Fox APT Uses Cyrillic False Flag in Teams SEO Poisoning to Deploy ValleyRAT.
  • Fri 26 Dec, 01:20 UTC. SecurityOnline. “Silver Fox” Unmasked: Chinese APT Group Impersonates Indian Tax Officials in Targeted Cyber Campaign.
  • Tue 30 Dec, 11:20 UTC. The Hacker News. Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware.
  • Fri 6 Feb, 01:41 UTC. SecurityOnline. Stealth Injection: Silver Fox APT Upgrades “ValleyRat” with Rare PoolParty Tech.
  • Mon 23 Feb, 12:56 UTC. Malwarebytes, its first report on the story. Silver Fox deploys ValleyRAT via typosquatted Huorong AV site.
  • Tue 24 Mar, 16:23 UTC. Infosecurity, its first report on the story. Silver Fox Cyber Campaigns Show Shift Toward Dual Espionage.
  • Tue 31 Mar, 12:55 UTC. The Hacker News. Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains.
  • Thu 30 Apr, 07:06 UTC. Securelist, its first report on the story. Silver Fox tax phishing campaign spreads ValleyRAT and ABCDoor.
  • Mon 4 May, 12:11 UTC. The Hacker News. Silver Fox Tax Phishing Hits Russia, India with ABCDoor.
  • Mon 4 May, 14:51 UTC. Dark Reading, its first report on the story. Silver Fox Uses Tax Scams to Deploy ABCDoor and ValleyRAT.
  • Mon 6 Jul, 14:11 UTC. SecurityOnline. ValleyRAT spreads via fake VLC installers targeting Asian users.
  • Fri 10 Jul, 13:46 UTC. The Hacker News. New MODBEACON RAT exploits gRPC stealth for encrypted attacks.
  • Sat 11 Jul, 02:30 UTC. SecurityOnline. Silver Fox uses SEO tricks to drop MODBEACON trojan via bugs. Cites a CVE in CISA KEV.
  • Thu 30 Jul, 11:10 UTC. The Hacker News. SilverFox uses three driver BYOVD with ValleyRAT on Japan maker.
  • Fri 31 Jul, 08:00 UTC. Security Affairs, its first report on the story. SilverFox targets Japanese maker with ValleyRAT via DLL sideload.
  • Fri 21 Aug, 17:06 UTC. dti.domaintools.com, its first report on the story. Silver Fox malware network adapts, uses cloud to launch attacks.
  • Mon 31 Aug, 11:28 UTC. SecurityOnline. ValleyRAT backdoor hides in fake signed installers targeting Asia.
  • Mon 31 Aug, 12:41 UTC. The Hacker News. ValleyRAT backdoor hides in adware via antivirus exclusions.
  • Mon 31 Aug, 20:32 UTC. Security Affairs. ValleyRAT malware hides in fake wallpaper app to spy on users.
  • Mon 7 Sep, 08:31 UTC. SecurityOnline. Fake Software Sites Target Chinese Users with Stealthy Malware Installers.
  • Fri 18 Sep, 20:58 UTC. dti.domaintools.com. DomainTools Uncovers Russia’s Secret Cyber Training Programmes. This article, 27th of 27.

DomainTools’ September 17, 2026 newsletter highlights research into leaked internal documents from Bauman Moscow State Technical University’s Department No. 4. The documents reportedly describe three training groups: one focused on special intelligence services, another on cyber operational effects, and a third on secure communications and technologies. DomainTools also identified an underreported financial-systems programme, alongside training in malware analysis and cyber threat intelligence. The findings are based on the leaked material and expand beyond public reporting that concentrated on the so-called “GRU Hacker School”.

The newsletter also reports continued activity in a malware-delivery domain “super-cluster” associated with the Silver Fox threat actor group, despite arrests by Chinese authorities of people linked to the group. DomainTools says its latest analysis identified three operational profiles and supports a previous hypothesis that the infrastructure may function as a decentralised malware-as-a-service platform. Samples from the activity were assessed as obfuscated variants of Gh0stRAT.

Although the initial lures varied, the reviewed samples reportedly shared nearly identical execution chains, obfuscation methods and final payload structures. The activity is described as targeting Chinese-speaking users; the newsletter does not state that the arrests or campaign activity resulted in confirmed victim numbers.

A separate investigation examined markets advertising fraudulent or stolen online accounts. DomainTools said weak fraud prevention at major email providers can enable the creation of fake email accounts that are later used for spam, malicious infrastructure, botnets and fraudulent accounts on other services. The research surveyed websites claiming to sell such accounts, but the newsletter provides no confirmed assessment of the sellers’ reliability or the scale of the market.

How the story developed

All 27 articles
Quiet for 6 weekslast report 18 Sep27 articles10 outlets

27 articles from 10 outlets since 28 Aug. Quiet since 18 Sep. This was the 27th report, 386 days after the first.

Now28 Aug272319112252419134272419112First reportCheck Point · 28 Aug, 14:45This article27th of 27 · day 386Exploited CVESecurityOnline · 11 Jul
  • Thu 28 Aug, 14:45 UTC. Check Point, first report. Chasing the Silver Fox: Cat & Mouse in Kernel Shadows.
  • Fri 29 Aug, 08:00 UTC. GBHackers, its first report on the story. Silver Fox Hackers Use Driver Vulnerability to Evade Security on Windows Systems.
  • Mon 1 Sep, 02:15 UTC. SecurityOnline, its first report on the story. Silver Fox APT Exploits Microsoft-Signed Driver to Deploy ValleyRAT Backdoor.
  • Tue 2 Sep, 10:15 UTC. The Hacker News, its first report on the story. Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware.
  • Sat 18 Oct, 07:15 UTC. The Hacker News. Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via HoldingHands RAT.
  • Thu 4 Dec, 17:55 UTC. The Hacker News. Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China.
  • Tue 9 Dec, 01:30 UTC. SecurityOnline. Silver Fox APT Uses Cyrillic False Flag in Teams SEO Poisoning to Deploy ValleyRAT.
  • Fri 26 Dec, 01:20 UTC. SecurityOnline. “Silver Fox” Unmasked: Chinese APT Group Impersonates Indian Tax Officials in Targeted Cyber Campaign.
  • Tue 30 Dec, 11:20 UTC. The Hacker News. Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware.
  • Fri 6 Feb, 01:41 UTC. SecurityOnline. Stealth Injection: Silver Fox APT Upgrades “ValleyRat” with Rare PoolParty Tech.
  • Mon 23 Feb, 12:56 UTC. Malwarebytes, its first report on the story. Silver Fox deploys ValleyRAT via typosquatted Huorong AV site.
  • Tue 24 Mar, 16:23 UTC. Infosecurity, its first report on the story. Silver Fox Cyber Campaigns Show Shift Toward Dual Espionage.
  • Tue 31 Mar, 12:55 UTC. The Hacker News. Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains.
  • Thu 30 Apr, 07:06 UTC. Securelist, its first report on the story. Silver Fox tax phishing campaign spreads ValleyRAT and ABCDoor.
  • Mon 4 May, 12:11 UTC. The Hacker News. Silver Fox Tax Phishing Hits Russia, India with ABCDoor.
  • Mon 4 May, 14:51 UTC. Dark Reading, its first report on the story. Silver Fox Uses Tax Scams to Deploy ABCDoor and ValleyRAT.
  • Mon 6 Jul, 14:11 UTC. SecurityOnline. ValleyRAT spreads via fake VLC installers targeting Asian users.
  • Fri 10 Jul, 13:46 UTC. The Hacker News. New MODBEACON RAT exploits gRPC stealth for encrypted attacks.
  • Sat 11 Jul, 02:30 UTC. SecurityOnline. Silver Fox uses SEO tricks to drop MODBEACON trojan via bugs. Cites a CVE in CISA KEV.
  • Thu 30 Jul, 11:10 UTC. The Hacker News. SilverFox uses three driver BYOVD with ValleyRAT on Japan maker.
  • Fri 31 Jul, 08:00 UTC. Security Affairs, its first report on the story. SilverFox targets Japanese maker with ValleyRAT via DLL sideload.
  • Fri 21 Aug, 17:06 UTC. dti.domaintools.com, its first report on the story. Silver Fox malware network adapts, uses cloud to launch attacks.
  • Mon 31 Aug, 11:28 UTC. SecurityOnline. ValleyRAT backdoor hides in fake signed installers targeting Asia.
  • Mon 31 Aug, 12:41 UTC. The Hacker News. ValleyRAT backdoor hides in adware via antivirus exclusions.
  • Mon 31 Aug, 20:32 UTC. Security Affairs. ValleyRAT malware hides in fake wallpaper app to spy on users.
  • Mon 7 Sep, 08:31 UTC. SecurityOnline. Fake Software Sites Target Chinese Users with Stealthy Malware Installers.
  • Fri 18 Sep, 20:58 UTC. dti.domaintools.com. DomainTools Uncovers Russia’s Secret Cyber Training Programmes. This article, 27th of 27.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 27 articles as a list
  1. Thu 28 AugDay 01
    1. Chasing the Silver Fox: Cat & Mouse in Kernel Shadows14:45 · Check Point · First report
  2. Fri 29 AugDay 11
    1. Silver Fox Hackers Use Driver Vulnerability to Evade Security on Windows Systems08:00 · GBHackers

  3. Quiet for 3 days

    Mon 1 SepDay 41
    1. Silver Fox APT Exploits Microsoft-Signed Driver to Deploy ValleyRAT Backdoor02:15 · SecurityOnline · Picked up again
  4. Tue 2 SepDay 51
    1. Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware10:15 · The Hacker News

  5. Quiet for 7 weeks

    Sat 18 OctDay 511
    1. Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via HoldingHands RAT07:15 · The Hacker News · Picked up again

  6. Quiet for 7 weeks

    Thu 4 DecDay 981
    1. Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China17:55 · The Hacker News · Picked up again

  7. Quiet for 4 days

    Tue 9 DecDay 1031
    1. Silver Fox APT Uses Cyrillic False Flag in Teams SEO Poisoning to Deploy ValleyRAT01:30 · SecurityOnline · Picked up again

  8. Quiet for 2 weeks

    Fri 26 DecDay 1201
    1. “Silver Fox” Unmasked: Chinese APT Group Impersonates Indian Tax Officials in Targeted Cyber Campaign01:20 · SecurityOnline · Picked up again

  9. Quiet for 4 days

    Tue 30 DecDay 1241
    1. Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware11:20 · The Hacker News · Picked up again

  10. Quiet for 5 weeks

    Fri 6 FebDay 1621
    1. Stealth Injection: Silver Fox APT Upgrades “ValleyRat” with Rare PoolParty Tech01:41 · SecurityOnline · Picked up again

  11. Quiet for 2 weeks

    Mon 23 FebDay 1791
    1. Silver Fox deploys ValleyRAT via typosquatted Huorong AV site12:56 · Malwarebytes · Picked up again

  12. Quiet for 4 weeks

    Tue 24 MarDay 2081
    1. Silver Fox Cyber Campaigns Show Shift Toward Dual Espionage16:23 · Infosecurity · Picked up again

  13. Quiet for 7 days

    Tue 31 MarDay 2151
    1. Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains12:55 · The Hacker News · Picked up again

  14. Quiet for 4 weeks

    Thu 30 AprDay 2451
    1. Silver Fox tax phishing campaign spreads ValleyRAT and ABCDoor07:06 · Securelist · Picked up again

  15. Quiet for 4 days

    Mon 4 MayDay 2492
    1. Silver Fox Tax Phishing Hits Russia, India with ABCDoor12:11 · The Hacker News · Picked up again
    2. Silver Fox Uses Tax Scams to Deploy ABCDoor and ValleyRAT14:51 · Dark Reading

  16. Quiet for 9 weeks

    Mon 6 JulDay 3121
    1. ValleyRAT spreads via fake VLC installers targeting Asian users14:11 · SecurityOnline · Picked up again

  17. Quiet for 4 days

    Fri 10 JulDay 3161
    1. New MODBEACON RAT exploits gRPC stealth for encrypted attacks13:46 · The Hacker News · Picked up again
  18. Sat 11 JulDay 3171
    1. Silver Fox uses SEO tricks to drop MODBEACON trojan via bugs02:30 · SecurityOnline · Exploited CVE · Known exploited CVE

  19. Quiet for 3 weeks

    Thu 30 JulDay 3361
    1. SilverFox uses three driver BYOVD with ValleyRAT on Japan maker11:10 · The Hacker News · Picked up again
  20. Fri 31 JulDay 3371
    1. SilverFox targets Japanese maker with ValleyRAT via DLL sideload08:00 · Security Affairs

  21. Quiet for 3 weeks

    Fri 21 AugDay 3581
    1. Silver Fox malware network adapts, uses cloud to launch attacks17:06 · dti.domaintools.com · Picked up again

  22. Quiet for 10 days

    Mon 31 AugDay 3683
    1. ValleyRAT backdoor hides in fake signed installers targeting Asia11:28 · SecurityOnline · Picked up again
    2. ValleyRAT backdoor hides in adware via antivirus exclusions12:41 · The Hacker News
    3. ValleyRAT malware hides in fake wallpaper app to spy on users20:32 · Security Affairs

  23. Quiet for 6 days

    Mon 7 SepDay 3751
    1. Fake Software Sites Target Chinese Users with Stealthy Malware Installers08:31 · SecurityOnline · Picked up again

  24. Quiet for 12 days

    Fri 18 SepDay 3861
    1. DomainTools Uncovers Russia’s Secret Cyber Training Programmes20:58 · dti.domaintools.com · Picked up again · This article, 27th of 27

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in