Silver Fox Hackers Target Indian Entities Using Income Tax Phishing Lures
CloudSEK's threat intelligence researchers have identified a sophisticated phishing campaign targeting Indian entities. This campaign employs Income Tax-themed lures and is attributed to the Chinese-aligned Silver Fox APT group.
CloudSEK's threat intelligence researchers have identified a sophisticated phishing campaign targeting Indian entities. This campaign employs Income Tax-themed lures and is attributed to the Chinese-aligned Silver Fox APT group.
The operation utilizes an advanced multi-stage malware chain to deliver Valley RAT, a modular remote access trojan. Valley RAT is designed for long-term persistence and dynamic payload delivery.
The identification of this campaign as being linked to Silver Fox marks the first public attribution and is critical for accurate threat actor identification for Indian cybersecurity defenders.
The campaign's initial access vector involves malicious email attachments containing PDFs impersonating official Income Tax correspondence. User interaction with these PDFs triggers automatic downloads of "tax affairs.exe," an NSIS installer that contains the first stage of the attack payload.
The installer exploits DLL hijacking against Thunder.exe, a legitimate executable from the Xunlei download manager, distributing the malicious libexpat.dll.
CloudSEK's threat intelligence researchers have identified a sophisticated phishing campaign targeting Indian entities.
Execution from the temporary directory ensures that libexpat.dll loads first, running the malware's core logic entirely in memory. The libexpat.dll payload includes extensive anti-analysis techniques, such as process enumeration to detect debugging tools and sandbox environment verification.
Upon confirming a legitimate environment, Windows Update services are disabled, a payload is decrypted from box.ini, and shellcode is injected into explorer.exe using process hollowing, maintaining stealth while establishing persistent code execution.
The final payload deploys Valley RAT, a sophisticated remote access trojan configured with three-tier C2 failover infrastructure. It uses dynamic beaconing with configurable sleep intervals to reduce detection likelihood. Operators can update C2 addresses through registry manipulation without redeploying binaries or regaining initial access.
Valley RAT's plugin architecture allows for on-demand deployment of post-exploitation capabilities, with downloaded modules stored as registry REG_BINARY values for automatic persistence across system reboots.
The campaign demonstrates advanced threat actor maturity through infrastructure compartmentalization, supported by rotating secondary domains. The injected payload can be examined by attaching a debugger to the hollowed explorer.exe process and monitoring the memory region allocated via VirtualAllocEx.
Organizations should implement detection strategies focusing on behavioral signatures rather than static indicators. This includes monitoring registry anomalies, detecting multi-tier C2 retry patterns, and alerting on signed binary execution from temporary directories paired with unusual DLL loads.
Memory-resident execution and registry-based persistence complicate incident response and malware eradication efforts. Proactive hunting for RAT feature enablement, particularly keylogging API activation, provides crucial early warning before data exfiltration occurs.
Based on reporting by GBHackers.