# Silver Fox APT Tax-Themed Phishing — RustSL Loader, ValleyRAT & New ABCDoor Python Backdoor

> Silver Fox APT ran tax-authority impersonation phishing campaigns against Indian organizations (Dec 2025) and Russian organizations (Jan 2026), distributing a customized Rust-based loader (RustSL) that delivers ValleyRAT (Winos 4.0) modules and a previously undocumented Python-based backdoor named ABCDoor. Over 1,600 malicious emails were observed between early January and early February 2026 targeting industrial, consulting, retail, and transportation sectors across Russia, India, Indonesia, South Africa, Cambodia, and Japan.

- **Published:** 2026-04-30T12:00:00Z
- **Last reviewed:** 2026-04-30T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0443
- **ID:** TL-2026-0443
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Void Arachne (China)
- **Detections:** 9 · **IOCs:** 69 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Silver Fox is a Chinese-language-aligned APT group historically associated with ValleyRAT (also known as Winos 4.0) and SwimSnake-related operations. Between December 2025 and February 2026 the group operated a multi-region tax-authority impersonation phishing campaign, generating more than 1,600 malicious emails analyzed by Kaspersky telemetry. The lures impersonated Indian tax authorities (Goods and Services Tax / Central Board of Direct Taxes), the Indian Ministry of Corporate Affairs, the Russian Federal Tax Service (фнс), and — from January 19, 2026 onward — Japanese tax authorities.

The attack chain begins with phishing emails carrying a PDF attachment that contains download links pointing to attacker-controlled distribution infrastructure such as abc.haijing88.com. Victims download a ZIP/SFX archive containing a customized variant of the open-source RustSL Rust loader. Two key Rust modules drive execution: steganography.rs implements an XOR-based custom payload unpacker with SHA-256 integrity verification, multiple encoding layers (Base64, Base32, Hex, urlsafe_base64) and a structured RSL_START/RSL_END framing format; guard.rs performs geofencing by querying five public geolocation services (ip-api.com, ipwho.is, ipinfo.io, ipapi.co, geoplugin.net) and only proceeds in a whitelisted target country list. The original public RustSL whitelists China; Silver Fox replaced it with Russia, India, Indonesia, South Africa, and Cambodia, then added Japan on January 19, 2026.

A RustSL sample compiled January 7, 2026 (MD5 2C5A1DD4CB53287FE0ED14E0B7B7B1B7) introduced a Phantom Persistence technique: by registering for application-restart notifications via RegisterApplicationRestart and SetProcessShutdownParameters, intercepting WM_QUERYENDSESSION, aborting the normal shutdown, and forcing a reboot with the EWX_RESTARTAPPS flag, the loader is automatically re-launched at the next OS startup with no on-disk autorun artifact. Debug strings reference 'Phantom Persistence Module (Hijack Mode)' and the loader uses HalosGate-style indirect syscalls for evasion.

RustSL delivers ValleyRAT through staged shellcode that downloads an Online module (上线模块.dll), which then loads a Login module (登录模块.dll_bin) and contacts C2 servers including 207.56.138.28:6666 and 108.187.37.85. ValleyRAT configuration is stored character-reversed under HKCU\Console (Console\0 for x86, Console\1 for x64) and HKCU\Software\IpDates_info, with campaign identifier '飘诈' (deception) and build date 2025.11.16.

A distinctive custom ValleyRAT plugin (保86.dll, two MD5 variants 4A5195A38A458CDD2C1B5AB13AF3B393 and E66BAE6E8621DB2A835FA6721C3E5BBE compiled 2025-12-04) downloads a 52.5 MB archive from 154.82.81.205 containing a portable Python environment plus ffmpeg.exe, extracts to %LOCALAPPDATA%\appclient\111.zip, runs an update.bat that copies the payload into C:\ProgramData\Tailscale (impersonating the legitimate Tailscale VPN), and launches the new ABCDoor backdoor via 'pythonw.exe -m appclient'.

ABCDoor is a previously undocumented Python backdoor compiled with Cython 3.0.7 and built on asyncio + Socket.IO. Its modular architecture exposes MainManager, MessageManager, AutoStartManager, ClientManager, SystemInfoManager, RemoteControlManager, FileManager, KeyboardManager, ProcessManager, ClipboardManager, CryptoManager (DPAPI-based file/dir encryption), and Utils classes. Capabilities include screen broadcasting across up to four monitors using the Desktop Duplication API and ffmpeg, double-click emulation while broadcasting, file_open command using ShellExecute, mouse/keyboard control via pynput, clipboard exfiltration, process and filesystem manipulation, and chunked file transfer. Persistence is achieved through HKCU\Software\Microsoft\Windows\CurrentVersion\Run:AppClient and a schtasks /sc minute /mo 1 /tn AppClient task that re-launches pythonw -m appclient every minute. The earliest known sample (v121, MD5 5b998a5bc5ad1c550564294034d4a62c) was compiled 2024-12-19, with progressive feature additions through v157 (Sept 2025).

ABCDoor C2 is reached over HTTPS to port 5000 on 45.118.133.203 and to a family of subdomains under fetish-friends.com, 3mkorealtd.com, sudsmama.com, woopami.com, ilptour.com, petitechanson.com, and doublemobile.com — all using the consistent 'abc.' subdomain prefix, which is the origin of the backdoor's name.

Attribution to Silver Fox is supported by historical use of ValleyRAT/Winos 4.0, Chinese-language artifacts throughout (飘诈, 上线模块, 登录模块, 测试插件 in PDB paths, 印度邮箱 in directory paths, Chinese console logging), the consistent multi-stage loader architecture, registry storage conventions, and continuity of tax-authority impersonation lures matched to historical Silver Fox campaigns. Confidence is HIGH per Kaspersky GReAT analysis.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 User Execution: Malicious File
- T1204.001 User Execution: Malicious Link
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.006 Command and Scripting Interpreter: Python
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1036.008 Masquerade File Type
- T1574.001 DLL
- T1070 Indicator Removal
- T1218.011 System Binary Proxy Execution: Rundll32
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1055 Process Injection
- T1614 System Location Discovery
- T1082 System Information Discovery
- T1012 Query Registry
- T1113 Screen Capture
- T1115 Clipboard Data
- T1056.001 Input Capture: Keylogging
- T1123 Audio Capture
- T1560 Archive Collected Data
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1583.001 Acquire Infrastructure: Domains
- T1587.001 Develop Capabilities: Malware

## Sources

- [Analyzing the Silver Fox tax campaign and the new ABCDoor backdoor](https://securelist.com/silver-fox-tax-notification-campaign/119575/)
- [MITRE ATT&CK — T1547.011 Plist File Modification / Shutdown-Triggered Execution](https://attack.mitre.org/)
- [MITRE ATT&CK — T1566.001 Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
- [MITRE ATT&CK — T1053.005 Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)
- [MITRE ATT&CK — T1547.001 Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001/)
- [MITRE ATT&CK — T1573.001 Symmetric Cryptography](https://attack.mitre.org/techniques/T1573/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0443