Silver Fox APT Tax-Themed Phishing — RustSL Loader, ValleyRAT & New ABCDoor Python Backdoor — Threadlinqs Intelligence
As of 2026-05-30, Silver Fox APT Tax-Themed Phishing — RustSL Loader, ValleyRAT & New ABCDoor Python Backdoor is a high-severity apt threat attributed to Void Arachne (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 69 indicators of compromise.
Threat ID: TL-2026-0443 · Severity: HIGH · Status: ACTIVE · Category: APT
Attribution: Void Arachne · China · ESPIONAGE
Silver Fox APT ran tax-authority impersonation phishing campaigns against Indian organizations (Dec 2025) and Russian organizations (Jan 2026), distributing a customized Rust-based loader (RustSL)
Silver Fox is a Chinese-language-aligned APT group historically associated with ValleyRAT (also known as Winos 4.0) and SwimSnake-related operations. Between December 2025 and February 2026 the group operated a multi-region tax-authority impersonation phishing campaign, generating more than 1,600 malicious emails analyzed by Kaspersky telemetry. The lures impersonated Indian tax authorities (Goods and Services Tax / Central Board of Direct Taxes), the Indian Ministry of Corporate Affairs, the Russian Federal Tax Service (фнс), and — from January 19, 2026 onward — Japanese tax authorities.
The attack chain begins with phishing emails carrying a PDF attachment that contains download links pointing to attacker-controlled distribution infrastructure such as abc.haijing88.com. Victims download a ZIP/SFX archive containing a customized variant of the open-source RustSL Rust loader. Two key Rust modules drive execution: steganography.rs implements an XOR-based custom payload unpacker with SHA-256 integrity verification, multiple encoding layers (Base64, Base32, Hex, urlsafe_base64) and a structured RSL_START/RSL_END framing format; guard.rs performs geofencing by querying five public geolocation services (ip-api.com, ipwho.is, ipinfo.io, ipapi.co, geoplugin.net) and only proceeds in a whitelisted target country list. The original public RustSL whitelists China; Silver Fox replaced it with Russia, India, Indonesia, South Africa, and Cambodia, then added Japan on January 19, 2026.
A RustSL sample compiled January 7, 2026 (MD5 2C5A1DD4CB53287FE0ED14E0B7B7B1B7) introduced a Phantom Persistence technique: by registering for application-restart notifications via RegisterApplicationRestart and SetProcessShutdownParameters, intercepting WM_QUERYENDSESSION, aborting the normal shutdown, and forcing a reboot with the EWX_RESTARTAPPS flag, the loader is automatically re-launched at the next OS startup with no on-disk autorun artifact. Debug strings reference 'Phantom Persistence Module (Hijack Mode)' and the loader uses HalosGate-style indirect syscalls for evasion.
RustSL delivers ValleyRAT through staged shellcode that downloads an Online module (上线模块.dll), which then loads a Login module (登录模块.dll_bin) and contacts C2 servers including 207.56.138.28:6666 and 108.187.37.85. ValleyRAT configuration is stored character-reversed under HKCU\Console (Console\0 for x86, Console\1 for x64) and HKCU\Software\IpDates_info, with campaign identifier '飘诈' (deception) and build date 2025.11.16.
A distinctive custom ValleyRAT plugin (保86.dll, two MD5 variants 4A5195A38A458CDD2C1B5AB13AF3B393 and E66BAE6E8621DB2A835FA6721C3E5BBE compiled 2025-12-04) downloads a 52.5 MB archive from 154.82.81.205 containing a portable Python environment plus ffmpeg.exe, extracts to %LOCALAPPDATA%\appclient\111.zip, runs an update.bat that copies the payload into C:\ProgramData\Tailscale (impersonating the legitimate Tailscale VPN), and launches the new ABCDoor backdoor via 'pythonw.exe -m appclient'.
ABCDoor is a previously undocumented Python backdoor compiled with Cython 3.0.7 and built on asyncio + Socket.IO. Its modular architecture exposes MainManager, MessageManager, AutoStartManager, ClientManager, SystemInfoManager, RemoteControlManager, FileManager, KeyboardManager, ProcessManager, ClipboardManager, CryptoManager (DPAPI-based file/dir encryption), and Utils classes. Capabilities include screen broadcasting across up to four monitors using the Desktop Duplication API and ffmpeg, double-click emulation while broadcasting, file_open command using ShellExecute, mouse/keyboard control via pynput, clipboard exfiltration, process and filesystem manipulation, and chunked file transfer. Persistence is achieved through HKCU\Software\Microsoft\Windows\CurrentVersion\Run:AppClient and a schtasks /sc minute /mo 1 /tn AppClient task that re-launches pythonw -m appclient every minute. The earliest known sample (v121, MD5 5b998a5bc5ad1c550564294034d4a62c) was compiled 2024-12-
Weaknesses (CWE)
CWE-1188, CWE-345
Target sectors: industrial, consulting, retail, transportation, government, financial
Target regions: Russia, India, Indonesia, South Africa, Cambodia, Japan
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 69 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, T1566, T1566.001, T1566.002, T1204.002, T1204.001, T1059.001, T1059.003, T1059.007, T1059.006, T1547.001