Silver Fox APT Tax-Themed Phishing — RustSL Loader, ValleyRAT & New ABCDoor Python Backdoor
Silver Fox APT Tax-Themed Phishing (TL-2026-0443), also tracked as Silver Fox tax notification campaign, is a high-severity advanced persistent threat campaign, first published 2026-04-30. It is attributed to Void Arachne (China) with high confidence, affects Microsoft Windows, maps to 36 MITRE ATT&CK techniques (T1012, T1027, T1036.005), and is covered by 9 detection rules and 69 indicators of compromise.
Key facts for TL-2026-0443
- Threat ID
- TL-2026-0443
- Also known as
- Silver Fox tax notification campaign, ABCDoor campaign, RustSL Phantom Persistence campaign, 飘诈 campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-04-30
- Last reviewed
- 2026-04-30
- Attribution
- Void Arachne
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- industrial, consulting, retail, transportation, government, financial
- Target regions
- Russia, India, Indonesia, South Africa, Cambodia, Japan
- Detection rules
- 9
- Indicators of compromise
- 69
Malware and tooling in Silver Fox APT Tax-Themed Phishing
Malware and tooling: ABCDoor, ValleyRAT, Winos 4.0, RustSL, ValleyRAT/Winos 4.0 C2
Silver Fox APT ran tax-authority impersonation phishing campaigns against Indian organizations (Dec 2025) and Russian organizations (Jan 2026), distributing a customized Rust-based loader (RustSL) that delivers ValleyRAT (Winos 4.0) modules and a previously undocumented Python-based backdoor named ABCDoor. Over 1,600 malicious emails were observed between early January and early February 2026 targeting industrial, consulting, retail, and transportation sectors across Russia, India, Indonesia, South Africa, Cambodia, and Japan.
How Silver Fox APT Tax-Themed Phishing works
Silver Fox is a Chinese-language-aligned APT group historically associated with ValleyRAT (also known as Winos 4.0) and SwimSnake-related operations. Between December 2025 and February 2026 the group operated a multi-region tax-authority impersonation phishing campaign, generating more than 1,600 malicious emails analyzed by Kaspersky telemetry. The lures impersonated Indian tax authorities (Goods and Services Tax / Central Board of Direct Taxes), the Indian Ministry of Corporate Affairs, the Russian Federal Tax Service (фнс), and — from January 19, 2026 onward — Japanese tax authorities.
The attack chain begins with phishing emails carrying a PDF attachment that contains download links pointing to attacker-controlled distribution infrastructure such as abc.haijing88.com. Victims download a ZIP/SFX archive containing a customized variant of the open-source RustSL Rust loader. Two key Rust modules drive execution: steganography.rs implements an XOR-based custom payload unpacker with SHA-256 integrity verification, multiple encoding layers (Base64, Base32, Hex, urlsafe_base64) and a structured RSL_START/RSL_END framing format; guard.rs performs geofencing by querying five public geolocation services (ip-api.com, ipwho.is, ipinfo.io, ipapi.co, geoplugin.net) and only proceeds in a whitelisted target country list. The original public RustSL whitelists China; Silver Fox replaced it with Russia, India, Indonesia, South Africa, and Cambodia, then added Japan on January 19, 2026.
A RustSL sample compiled January 7, 2026 (MD5 2C5A1DD4CB53287FE0ED14E0B7B7B1B7) introduced a Phantom Persistence technique: by registering for application-restart notifications via RegisterApplicationRestart and SetProcessShutdownParameters, intercepting WM_QUERYENDSESSION, aborting the normal shutdown, and forcing a reboot with the EWX_RESTARTAPPS flag, the loader is automatically re-launched at the next OS startup with no on-disk autorun artifact. Debug strings reference 'Phantom Persistence Module (Hijack Mode)' and the loader uses HalosGate-style indirect syscalls for evasion.
RustSL delivers ValleyRAT through staged shellcode that downloads an Online module (上线模块.dll), which then loads a Login module (登录模块.dll_bin) and contacts C2 servers including 207.56.138.28:6666 and 108.187.37.85. ValleyRAT configuration is stored character-reversed under HKCU\Console (Console\0 for x86, Console\1 for x64) and HKCU\Software\IpDates_info, with campaign identifier '飘诈' (deception) and build date 2025.11.16.
A distinctive custom ValleyRAT plugin (保86.dll, two MD5 variants 4A5195A38A458CDD2C1B5AB13AF3B393 and E66BAE6E8621DB2A835FA6721C3E5BBE compiled 2025-12-04) downloads a 52.5 MB archive from 154.82.81.205 containing a portable Python environment plus ffmpeg.exe, extracts to %LOCALAPPDATA%\appclient\111.zip, runs an update.bat that copies the payload into C:\ProgramData\Tailscale (impersonating the legitimate Tailscale VPN), and launches the new ABCDoor backdoor via 'pythonw.exe -m appclient'.
ABCDoor is a previously undocumented Python backdoor compiled with Cython 3.0.7 and built on asyncio + Socket.IO. Its modular architecture exposes MainManager, MessageManager, AutoStartManager, ClientManager, SystemInfoManager, RemoteControlManager, FileManager, KeyboardManager, ProcessManager, ClipboardManager, CryptoManager (DPAPI-based file/dir encryption), and Utils classes. Capabilities include screen broadcasting across up to four monitors using the Desktop Duplication API and ffmpeg, double-click emulation while broadcasting, file_open command using ShellExecute, mouse/keyboard control via pynput, clipboard exfiltration, process and filesystem manipulation, and chunked file transfer. Persistence is achieved through HKCU\Software\Microsoft\Windows\CurrentVersion\Run:AppClient and a schtasks /sc minute /mo 1 /tn AppClient task that re-launches pythonw -m appclient every minute. The earliest known sample (v121, MD5 5b998a5bc5ad1c550564294034d4a62c) was compiled 2024-12-19, with progressive feature additions through v157 (Sept 2025).
ABCDoor C2 is reached over HTTPS to port 5000 on 45.118.133.203 and to a family of subdomains under fetish-friends.com, 3mkorealtd.com, sudsmama.com, woopami.com, ilptour.com, petitechanson.com, and doublemobile.com — all using the consistent 'abc.' subdomain prefix, which is the origin of the backdoor's name.
Attribution to Silver Fox is supported by historical use of ValleyRAT/Winos 4.0, Chinese-language artifacts throughout (飘诈, 上线模块, 登录模块, 测试插件 in PDB paths, 印度邮箱 in directory paths, Chinese console logging), the consistent multi-stage loader architecture, registry storage conventions, and continuity of tax-authority impersonation lures matched to historical Silver Fox campaigns. Confidence is HIGH per Kaspersky GReAT analysis.
MITRE ATT&CK techniques used in TL-2026-0443
Discovery
T1012 Query Registry; T1082 System Information Discovery; T1614 System Location Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1036.008 Masquerade File Type; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1218.011 System Binary Proxy Execution: Rundll32; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1574.001 DLL
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1546 Event Triggered Execution; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Collection
T1056.001 Input Capture: Keylogging; T1113 Screen Capture; T1115 Clipboard Data; T1123 Audio Capture; T1560 Archive Collected Data
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573.001 Encrypted Channel: Symmetric Cryptography
Initial Access
T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1587.001 Develop Capabilities: Malware
Affected products and versions in Silver Fox APT Tax-Themed Phishing
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022 - Tax Authorities (impersonated, not vulnerable) — GST / CBDT / MCA (India), Federal Tax Service (Russia), National Tax Agency (Japan)
Remediation for Silver Fox APT Tax-Themed Phishing
Patches
- No vendor patch is applicable; this is a phishing-and-malware campaign rather than a software vulnerability
Immediate actions
- Block all listed ABCDoor C2 IPs and abc.* subdomains at perimeter and DNS layers
- Block ValleyRAT C2 IPs 108.187.37.85, 108.187.42.63, 207.56.138.28 and the 154.82.81.0/24 distribution range
- Quarantine emails matching tax-authority lures (GST, CBDT, MCA, фнс, Japanese tax) with PDF attachments containing external download links
- Hunt for HKCU\Software\Microsoft\Windows\CurrentVersion\Run:AppClient and Task Scheduler entries named AppClient
- Hunt for unexpected pythonw.exe processes with -m appclient argument and writes to C:\ProgramData\Tailscale\ when Tailscale is not deployed
- Hunt for HKCU\Console\IpDate, HKCU\Software\IpDates_info, HKCU\Software\CarEmu registry keys
Workarounds
- Disable Office macros and JavaScript file association (.js) execution outside of admin-approved scripts
- Restrict execution of unsigned PowerShell scripts via Constrained Language Mode and ExecutionPolicy AllSigned
- Block SFX (.exe) inside ZIP archives at the email gateway and unpack-and-inspect at the proxy
Longer-term hardening
- Deploy EDR with behavioral detection for shutdown-event hijacking, RegisterApplicationRestart abuse, and EWX_RESTARTAPPS-triggered reboots
- Enforce email security gateway with attachment sandboxing for PDF, ZIP, and SFX archives originating from external senders
- Implement application allowlisting to restrict pythonw.exe execution from %LOCALAPPDATA%, %TEMP%, and C:\ProgramData paths
- Monitor for outbound connections to geolocation lookup services (ip-api.com, ipwho.is, ipinfo.io, ipapi.co, geoplugin.net) from non-browser processes
- Enable PowerShell ScriptBlock and Module logging plus Sysmon Event ID 1, 7, 11, 12, 13 with Run-key, schtasks, and ProgramData write coverage
Weaknesses (CWE) in Silver Fox APT Tax-Themed Phishing
CWE-1188, CWE-345
Timeline of Silver Fox APT Tax-Themed Phishing
- Earliest known ABCDoor sample (v121, MD5 5b998a5bc5ad1c550564294034d4a62c) compiled — minimal functionality with GDI-based ffmpeg and registry persistence.
- ABCDoor v143 introduces task-scheduler persistence, OOP redesign, clipboard module, process module, and asymmetric encryption.
- ABCDoor v152 adds DPAPI-based file/directory encryption and chunked uploads.
- ABCDoor v157 adds Desktop Duplication API multi-monitor screen broadcasting (up to four displays).
- ABCDoor v157 recompiled with Cython 3.0.7 to harden against Python decompilation.
- India tax phishing wave begins — GST.pdf and CBDT.rar lures sent via SendGrid impersonating Indian tax authorities.
- Custom ValleyRAT plugin 保86.dll variants compiled (MD5 4A5195A38A458CDD2C1B5AB13AF3B393 and E66BAE6E8621DB2A835FA6721C3E5BBE) to download the 52.5 MB ABCDoor archive from 154.82.81.205.
- Russia tax phishing wave launches — фнс.zip lures impersonating the Russian Federal Tax Service.
- RustSL sample (MD5 2C5A1DD4CB53287FE0ED14E0B7B7B1B7) introduces Phantom Persistence — shutdown hijack via RegisterApplicationRestart and EWX_RESTARTAPPS with HalosGate indirect syscalls.
- Japan added to RustSL guard.rs geofencing whitelist; Japanese tax-themed lures observed (sample MD5 E6362A81991323E198A463A8CE255533).
- Kaspersky telemetry confirms 1,600+ malicious emails delivered across the campaign window targeting industrial, consulting, retail, and transportation sectors.
- Kaspersky Securelist publishes comprehensive technical analysis naming the new ABCDoor backdoor and documenting RustSL Phantom Persistence.
- As of 2026-05-29, Silver Fox APT remains active and undisrupted (no arrests/takedowns); its ValleyRAT/ABCDoor/RustSL toolset stays in real-world use per Kaspersky, with disclosure on Apr 30 2026 and press through mid-May. The actor is escalating in parallel (Mar 2026 AtlasCross RAT, Python stealers), and no C2 sinkholing is reported, so the threat is live.
Sources cited for Silver Fox APT Tax-Themed Phishing
- Analyzing the Silver Fox tax campaign and the new ABCDoor backdoor
- Securelist (Kaspersky) — Silver Fox tax notification campaign
- MITRE ATT&CK — T1547.011 Plist File Modification / Shutdown-Triggered Execution
- MITRE ATT&CK — T1566.001 Spearphishing Attachment
- MITRE ATT&CK — T1053.005 Scheduled Task
- MITRE ATT&CK — T1547.001 Registry Run Keys / Startup Folder
- MITRE ATT&CK — T1573.001 Symmetric Cryptography
Threats related to Silver Fox APT Tax-Themed Phishing
- SilverFox APT Deploys Advanced ValleyRAT Campaign Against Japanese Manufacturer via DLL Sideloading and BYOVD
- ValleyRAT via Fake Huorong AV Site — Silver Fox APT DLL Sideloading, Winos4.0 Framework, Encrypted Shellcode Persistence
- Silver Fox APT Distributes ValleyRAT via Typosquatted Telegram Download Portals
- China-Linked Threat Actor Integrates Claude Code and DeepSeek-v4-pro into Active Espionage Operations Against Government, Supply-Chain, and Financial Targets
Detection coverage for TL-2026-0443
As of 2026-04-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0443 across Splunk SPL, Microsoft KQL and Sigma, covering 69 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.