# Silver Fox APT Tax-Themed Phishing Campaigns Deploying ValleyRAT, BYOVD Driver Abuse, and Kernel Rootkits

> Silver Fox (Void Arachne), a China-based intrusion set active since 2022, conducts dual APT-espionage and cybercrime operations across the Asia-Pacific region. The group deploys ValleyRAT (Winos 4.0) via tax-themed phishing and SEO poisoning, abuses the Microsoft-signed WatchDog driver (amsdk.sys) for BYOVD privilege escalation and EDR termination, and leverages the Nidhogg kernel-mode rootkit for deep persistence and defense evasion.

- **Published:** 2026-03-24T12:00:00Z
- **Last reviewed:** 2026-03-24T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0276
- **ID:** TL-2026-0276
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Void Arachne (China)
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Silver Fox, also tracked as Void Arachne, SwimSnake, The Great Thief of Valley, and UTG-Q-1000, is a sophisticated China-based advanced persistent threat group that has evolved from financially motivated cybercrime to a dual-track operational model combining state-aligned espionage with criminal profit generation. Active since at least the second half of 2022, the group has conducted sustained campaigns targeting Chinese-speaking populations and organizations across Taiwan, China, Vietnam, Japan, Malaysia, India, Indonesia, Singapore, Thailand, and the Philippines.

The group's primary payload is ValleyRAT, a modular C++ remote access trojan also known as Winos 4.0, which operates through a multi-stage infection chain. Initial access is achieved through tax-themed phishing emails impersonating national taxation authorities (particularly Taiwan's National Taxation Bureau), with malicious PDF or ZIP attachments containing DLL files. The group also employs SEO poisoning to distribute trojanized versions of legitimate software including Google Chrome, Microsoft Teams, Telegram, DeepSeek AI, and WPS Office.

ValleyRAT's infection chain involves multiple stages: (1) an initial loader with anti-VM, anti-sandbox, and hypervisor detection capabilities, (2) a beaconing module that performs privilege escalation via CMSTPLUA COM class abuse and fodhelper.exe UAC bypass, (3) a RuntimeBroker persistence component that manipulates the HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\Command registry key, (4) shellcode injection into svchost.exe for defense evasion, and (5) the final ValleyRAT payload with 16+ command capabilities including screen monitoring, keystroke logging, clipboard manipulation, USB device monitoring, and arbitrary shellcode execution.

A defining characteristic of Silver Fox's operations is their Bring Your Own Vulnerable Driver (BYOVD) campaign, first detected by Check Point Research in May 2025. The group exploits a previously unknown vulnerability in the WatchDog Antimalware driver (amsdk.sys, version 1.0.600), built on the Zemana Anti-Malware SDK. Despite being Microsoft-signed with a valid certificate, the driver lacks the FILE_DEVICE_SECURE_OPEN flag and fails to verify Protected Process Light (PPL) status, enabling arbitrary process termination of 192 hardcoded security products including 360 Safe, Kingsoft Antivirus, Tencent QQ PCMgr, and Kaspersky. When targeting Windows 7 systems, the group falls back to the known vulnerable Zemana driver (zam.exe). Notably, after the vendor released a patched driver (wamsdk.sys v1.1.100), Silver Fox attackers bypassed the patch by flipping a single byte in the RFC 3161 timestamp field, preserving the valid Microsoft signature while changing the file hash to evade blocklists.

The group's toolkit extends beyond ValleyRAT to include HoldingHands RAT (a Gh0st RAT variant deployed for premium espionage operations with 60-second heartbeat intervals and dynamic C2 updates), CleverSoar (an MSI-based installer that checks for Chinese/Vietnamese language settings before proceeding), the open-source Nidhogg kernel-mode rootkit (providing process hiding, file protection, registry concealment, AMSI bypass, ETW patching, and PP/PPL signature modification), and Blackmoon (financially motivated malware from the Chinese cybercrime ecosystem). A Python-based stealer impersonating WhatsApp was observed in 2026 campaigns.

C2 infrastructure is hosted across multiple providers including Alibaba Cloud, CTG Server LTD, and Chinese hosting providers. Communication employs HTTP File Server (HFS) for ValleyRAT delivery and TCP-based encrypted channels for Winos 4.0, with XOR encryption (keys including 0x60 and 0x36) and AES-256 for shellcode protection.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1548 Abuse Elevation Control Mechanism
- T1068 Exploitation for Privilege Escalation
- T1014 Rootkit
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1553 Subvert Trust Controls
- T1055 Process Injection
- T1497 Virtualization/Sandbox Evasion
- T1202 Indirect Command Execution
- T1056 Input Capture
- T1057 Process Discovery
- T1082 System Information Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1115 Clipboard Data
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking

## Sources

- [Sekoia TDR: Silver Fox Tax Audit Campaign Analysis](https://blog.sekoia.io/silver-fox-the-only-tax-audit-where-the-fine-print-installs-malware/)
- [Check Point Research: Chasing the Silver Fox - Cat & Mouse in Kernel Shadows](https://research.checkpoint.com/2025/silver-fox-apt-vulnerable-drivers/)
- [Fortinet FortiGuard Labs: ValleyRAT Campaign Targeting Chinese Speakers](https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers)
- [ReliaQuest: Silver Fox Russian Ruse - Fake Microsoft Teams Attack](https://reliaquest.com/blog/threat-spotlight-silver-foxs-russian-ruse-fake-microsoft-teams-attack/)
- [The Hacker News: Silver Fox Exploits Microsoft-Signed WatchDog Driver](https://thehackernews.com/2025/09/silver-fox-exploits-microsoft-signed.html)
- [The Hacker News: Silver Fox APT Uses Winos 4.0 Against Taiwanese Organizations](https://thehackernews.com/2025/02/silver-fox-apt-uses-winos-40-malware-in.html)
- [Forescout: Healthcare Malware Hunt - Silver Fox Targets Philips DICOM Viewers](https://www.forescout.com/blog/healthcare-malware-hunt-part-1-silver-fox-apt-targets-philips-dicom-viewers/)
- [Nidhogg Rootkit GitHub Repository](https://github.com/Idov31/Nidhogg)
- [Picus Security: Silver Fox APT Targets Public Sector via Trojanized Medical Software](https://www.picussecurity.com/resource/blog/silver-fox-apt-targets-public-sector-via-trojanized-medical-software)
- [Industrial Cyber: Forescout Details Silver Fox Campaign Targeting Healthcare](https://industrialcyber.co/medical/forescout-details-silver-fox-campaign-targeting-healthcare-with-backdoors-keyloggers-crypto-miners/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0276