CyberSIXT Search
Threat actor

Silver Fox

Tracked by CyberSIXT since 28 Aug 2025

Articlesall time
27
Articleslast 30 days
0
CVEs exploitedattributed · all time
2
Research reportsall time
3

27 articles from 10 outlets; the latest 37 days ago.

Silver Fox: coverage over time27 articles from 10 outlets, 13 of them before 9 Apr. Busiest week: 3 articles, week of 31 Aug. 0 in the last 7 days. Silver Fox: coverage over time27 articles from 10 outlets, 13 of them before 9 Apr. Busiest week: 3 articles, week of 31 Aug. 0 in the last 7 days.
  • Article
  • Research report
Show as table
Silver Fox: articles
Published (UTC)OutletHeadline
Fri 18 Sep · 20:58 UTCdti.domaintools.comDomainTools Uncovers Russia’s Secret Cyber Training Programmes
Mon 7 Sep · 08:31 UTCSecurityOnlineFake Software Sites Target Chinese Users with Stealthy Malware Installers
Mon 31 Aug · 20:32 UTCSecurity AffairsValleyRAT malware hides in fake wallpaper app to spy on users
Mon 31 Aug · 12:41 UTCThe Hacker NewsValleyRAT backdoor hides in adware via antivirus exclusions
Mon 31 Aug · 11:28 UTCSecurityOnlineValleyRAT backdoor hides in fake signed installers targeting Asia
Fri 21 Aug · 17:06 UTCdti.domaintools.comSilver Fox malware network adapts, uses cloud to launch attacks
Fri 31 Jul · 08:00 UTCSecurity AffairsSilverFox targets Japanese maker with ValleyRAT via DLL sideload
Thu 30 Jul · 11:10 UTCThe Hacker NewsSilverFox uses three driver BYOVD with ValleyRAT on Japan maker
Sat 11 Jul · 02:30 UTCSecurityOnlineSilver Fox uses SEO tricks to drop MODBEACON trojan via bugs
Fri 10 Jul · 13:46 UTCThe Hacker NewsNew MODBEACON RAT exploits gRPC stealth for encrypted attacks
Mon 6 Jul · 14:11 UTCSecurityOnlineValleyRAT spreads via fake VLC installers targeting Asian users
Mon 4 May · 14:51 UTCDark ReadingSilver Fox Uses Tax Scams to Deploy ABCDoor and ValleyRAT
See the full timeline

Profile

Written by CyberSIXT from the sources listed below. Updated 26 Oct.

Malpedia and MISP Galaxy list Void Arachne as an alias for Silver Fox2,3. Malpedia associates Silver Fox with Winos4.

The Hacker News reported that Silver Fox targeted a Japanese manufacturer with a three-driver Bring Your Own Vulnerable Driver attack and ValleyRAT5. SecurityOnline cited Qianxin's Red Raindrop Team on Silver Fox distributing the MODBEACON Rust trojan to technology, education, and state-owned enterprises in Asia through trojanized installers6. SecurityOnline linked a fake VLC installer email campaign to suspected Silver Fox activity, while describing attribution as unconfirmed7. Malwarebytes attributed a fake Huorong Security site delivering ValleyRAT through DLL sideloading to Silver Fox1.

Sources

  1. Silver Fox deploys ValleyRAT via typosquatted Huorong AV site · Malwarebytes · 2026-02-23
  2. Silver Fox: alias · Malpedia
  3. Silver Fox: alias · MISP Galaxy
  4. Silver Fox: software · Malpedia
  5. SilverFox uses three driver BYOVD with ValleyRAT on Japan maker · The Hacker News · 2026-07-30
  6. Silver Fox uses SEO tricks to drop MODBEACON trojan via bugs · SecurityOnline · 2026-07-11
  7. ValleyRAT spreads via fake VLC installers targeting Asian users · SecurityOnline · 2026-07-06

Diamond Model

What the record links to Silver Fox

Recorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).

Adversary4namesVoid Arachne, Silver Fox APT, SilverFoxCyberSIXT coverage, Malpedia, MISP GalaxyCapability31 malware or tool · 2 exploited CVEsWinos, CVE-2026-48939, CVE-2026-56291Malpedia, CyberSIXT coverage
InfrastructureNot recorded for this actor
VictimNot recorded

Names and sources

Void Arachne
CyberSIXT coverage, Malpedia, MISP Galaxy
Silver Fox
Malpedia, MISP Galaxy
Silver Fox APT
CyberSIXT coverage
SilverFox
CyberSIXT coverage

CVEs exploited

2 CVEs an article attributes to Silver Fox
CVE-2026-48939iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability · attributed by Qianxin's Red Raindrop Team, 11 Jul · Source articleCVSS10.0CriticalExploited20%EPSS0articles
CVE-2026-56291Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability · attributed by Qianxin's Red Raindrop Team, 11 Jul · Source articleCVSS10.0CriticalExploited15%EPSS0articles

Vendors targeted

iCagenda 1 attributed CVEBalbooa 1 attributed CVE

Malware and tools

Malpedia · void_arachne 1

Winos

MITRE ATT&CK® techniques

No MITRE ATT&CK® techniques are recorded for Silver Fox.

Include passing mentions (1)

Coverage

27 articles, all timeFull timeline RSS feed
  1. DomainTools Uncovers Russia’s Secret Cyber Training Programmesdti.domaintools.com
  2. Fake Software Sites Target Chinese Users with Stealthy Malware InstallersSecurityOnline
  3. ValleyRAT malware hides in fake wallpaper app to spy on usersSecurity Affairs
  4. ValleyRAT backdoor hides in adware via antivirus exclusionsThe Hacker News
  5. ValleyRAT backdoor hides in fake signed installers targeting AsiaSecurityOnline
  6. Silver Fox malware network adapts, uses cloud to launch attacksdti.domaintools.com
  7. SilverFox targets Japanese maker with ValleyRAT via DLL sideloadSecurity Affairs
  8. SilverFox uses three driver BYOVD with ValleyRAT on Japan makerThe Hacker News
  9. Silver Fox uses SEO tricks to drop MODBEACON trojan via bugsSecurityOnline
  10. New MODBEACON RAT exploits gRPC stealth for encrypted attacksThe Hacker News
  11. ValleyRAT spreads via fake VLC installers targeting Asian usersSecurityOnline
  12. Silver Fox Uses Tax Scams to Deploy ABCDoor and ValleyRATDark Reading

The latest 12 are listed. See all 27 articles in the timeline.

Research reports

Learn more

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device