Silver Fox APT Uses Cyrillic False Flag in Teams SEO Poisoning to Deploy ValleyRAT

According to ReliaQuest, the Chinese APT cluster known as “Silver Fox” (or Void Arachne) has launched a sophisticated SEO poisoning campaign that impersonates Microsoft Teams to distribute ValleyRAT, with the attackers trying hard to look Russian. The operation uses Cyrillic elements in its attack chain, including a malicious ZIP file named МЅТчатѕSetup[.]zip that runs an executable in Russian.

Active since November 2025, the campaign targets Chinese-speaking users, including those within Western organisations operating in China, and relies on a typo-squatted domain teamscn[.]com designed to resemble a legitimate Chinese download portal for Microsoft Teams. Once downloaded, the fake installer installs ValleyRAT, with the installer mimicking a legitimate setup and employing PowerShell to add Windows Defender exclusions and evading security software such as 360 Total Security.

ReliaQuest notes that these “false flags” are likely an intentional bid to mislead attribution and frame a Russian threat group for the intrusion, while the infrastructure linked to CTG Server LTD points back to Silver Fox.