“Silver Fox” Unmasked: Chinese APT Group Impersonates Indian Tax Officials in Targeted Cyber Campaign

A new intelligence report from CloudSEK’s TRIAD identifies the Chinese APT group Silver Fox as the threat behind a targeted cyber campaign aimed at Indian organisations, with the attack described as a tax-themed phishing lure as tax season approaches. The campaign begins with a spear-phishing email that appears to come from a legitimate entity, TOPSOE India Private Limited, attaching a ZIP named tax affairs[.]zip that contains tax affairs.exe, a decoy designed to deliver Valley RAT.

Once executed, Valley RAT grants attackers remote access and unfolds through process hollowing, with a malicious DLL (libexpat.dll) subsequently injecting code into Windows processes such as Thunder.exe and explorer.exe to communicate with its C2 server at b.yuxuanow[.]top:443.

CloudSEK also notes a network of malicious domains—including itdd[.]club, gov-a[.]work, and govk[.]club—hosted on the same IP addresses, designed to appear as legitimate tax notices in multiple languages, including a Hindi translation “कर नोटिस.” The analysis corrects earlier attribution to SideWinder APT and underscores that accurate attribution is critical for defenders to target the correct threat actor. According to CloudSEK, the campaign marks Silver Fox’s expansion into the Indian subcontinent.