Silver Fox
Silver Fox is a malware family and associated cybercrime activity cluster active since at least 2022, with campaigns observed through 2024 and ongoing reporting into 2025–2026. Reporting from Knownsec describes Silver Fox operations that impersonate popular software and services, including Google Translate, WPS, currency converters, Youdao Translation, Bit Browser, LetsVPN, and fake Flash update prompts, to deliver Trojanized MSI or EXE installers. Distribution methods explicitly mentioned include email, phishing websites, instant messaging software, counterfeit software download pages, SEO optimization, and fake websites of important national institutions.
In the analyzed infection chain, an MSI installer loads aicustact.dll, executes update.bat, uses javaw.exe to establish persistence by writing Microsoftdata.exe into the Windows Run registry, and then reads Xps.dtd to load shellcode that decrypts and executes the final payload. The final PE reportedly contains the string "RexRat4.0.3," but the core malware was assessed as Winos, described as one of the most common Trojans in the Silver Fox family. Winos is modular and supports remote control and data theft via plug-ins, with specifically reported capabilities including screenshot capture, keylogging, clipboard theft, and broader remote-control and data-theft functions.
The content states that leaked source code such as Winos 4.0 enabled Silver Fox to evolve from a single organization into a broadly reused malware family. The malware is described as increasingly modular and tool-based, with core code reportedly reused by multiple cybercrime groups and some APT organizations, including Golden Eye Dog. The reporting characterizes Silver Fox as a significant threat in the Chinese internet ecosystem.
High-confidence infrastructure and indicators mentioned in the content include phishing infrastructure 192.252.181[.]55 and www.ggfanyi[.]com, and command-and-control endpoints 8.218.115.90:8080, 8.218.115.90:8081, 154.91.66.58:8088, 154.91.66.58:8089, 103.116.246.234:6234, 43.250.174.49:1989, 154.222.24.214:886, 154.222.24.214:668, 206.119.167.191:8003, 206.119.167.191:8004, 1.94.163.46:666, 203.160.55.201:1860, 154.94.232.242:8888, and 154.94.232.242:6666.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recently, the Knownsec 404 Advanced Threat Intelligence Team has frequently detected Silver Fox attack activities that mimic popular tools.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
IOCs tracked for this family
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as part of a prior investigation and pivot chain tied to the same hosting infrastructure. The content does not provide functional malware details beyond indicating it is associated with earlier campaign mapping.
Referenced as a trojan involved in stealing activities in prior public reporting related to the broader actor/tooling context.
A modular Trojan family spread via fake software download pages, SEO poisoning, phishing sites, and fake Flash update lures. It compromises hosts through malicious installers and supports remote control and data theft.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.