Loading story…
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around PXDropper, the PoisonX kernel driver, and the modular 10FXRAT remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as RuntimeBroker.exe. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including dashost.exe and unregmp2.exe to decrypt and launch the malware.
Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to BYOVD techniques using legitimately signed but vulnerable drivers such as ASUSTeK EneIo64.sys and Microsoft procexp.sys. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket opentokenaiit, the URL https://storage.googleapis.com/opentokenaiit/newgram.exe, and C2 address 101.32.190.202. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to Silver Fox.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-04, LAC WATCH published a report detailing the campaign's spear-phishing lures, PXDropper, PoisonX driver abuse, 10FXRAT deployment, and later BYOVD evolution. The report assessed with low-to-moderate confidence that the activity may be linked to the China-aligned Silver Fox group, while noting attribution was not conclusive.
The IP address 101.32.190.202, later highlighted as a strong candidate C2 in analysis of the campaign, appeared in an OTX botnet-list pulse on 2026-05-20. The gist cites this as independent enrichment for one of the reported indicators.
LAC said similar activity continued into May 2026 and expanded targeting beyond Japan to include Chinese organizations. During this phase, the operators shifted from the PoisonX driver to BYOVD techniques using legitimately signed vulnerable drivers such as ASUSTeK EneIo64.sys and Microsoft's procexp.sys.
LAC observed a spear-phishing campaign in April 2026 targeting Japanese organizations with HR-themed lures impersonating company representatives. The infection chain delivered PXDropper, a PoisonX kernel driver, and 10FXRAT via archives and downloader files hosted on Google Cloud Storage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence linked multiple March and April malware waves to the **SilverFox** threat actor, describing a broad Chinese-language campaign built around **ValleyRAT** on the `Winos4.0` framework and supported by **Gh0stRAT** and **RustyStealer**. The operation used emotionally charged lures tied to layoffs, disciplinary notices, scam-compound violence, banking fraud, censorship-bypass tools, fake utilities, and business apps, with delivery through WinRAR self-extracting archives, MSI and ZIP packages, DLL sideloading, process hollowing, and staged downloads. One ValleyRAT chain disguised itself as a WeChat-related document, extracted files into `C:\WeChat\`, launched a legitimate WeChat binary as a decoy, and then decrypted and injected the payload while applying Chinese-locale geofencing, anti-VM, and anti-debug checks. Researchers said the malware families provided complementary functions including remote access, keylogging, screenshot capture, clipboard hijacking, credential theft, and persistence, and that targeting extended from mainland Chinese users to diaspora communities, Taiwanese organizations, and some healthcare entities in North America. The infrastructure behind the campaign scaled rapidly, with reporting tying the activity to **22 to 75 command-and-control endpoints** and more than 17 domains across Alibaba Cloud, Tencent Cloud, AWS Hong Kong, Vultr, Azure, Huawei Cloud, and other providers, with Hong Kong serving as a major hub. Analysts connected the clusters through shared protocol behavior, mutexes, ValleyRAT DLL exports, recurring registrar patterns, use of the `codemark` builder variant, and repeated OPSEC failures including exposed RDP services, self-signed certificates, Python SimpleHTTP payload hosting, a Windows host identified as `TEDDY2012`, and domain registration details that appeared to expose operator identity. Separate reporting also described a related **Gh0stRAT/Farfli** "WisemanSupport" campaign using TCP/6658 and hardcoded infrastructure, reinforcing the continued use of Chinese-nexus RAT tooling and overlapping tradecraft in active intrusion operations.
Jun 29, 2026
Silver Fox launched a targeted spearphishing campaign against Japanese businesses during tax filing and organizational change season, using localized lures tied to tax compliance violations, salary adjustments, personnel changes, employee stock plans, and invoice themes. Researchers said the actor conducted reconnaissance before sending emails, impersonated real employees and executives, and often inserted the victim company’s name into subject lines to make messages appear legitimate. The emails pushed recipients to open malicious attachments or download archives from public file-sharing services such as gofile[.]io and WeTransfer, with filenames crafted to resemble routine HR, finance, and tax documents. The campaign delivered **ValleyRAT** (ESET detection: `Win64/Valley`), a remote access trojan capable of remote control, persistence, information theft, user monitoring, and potential lateral movement. Separate analysis tied one Japanese-language Rakuten invoice lure to a DLL sideloading chain abusing Dell MaxxAudio, after which the malware beaconed to a Hong Kong-based command-and-control server over port `886`; investigators also noted configuration overlaps with **Gh0st RAT** defaults and fabricated WHOIS data linked to a Chinese registrant email. The activity follows similar seasonal operations seen the previous year and reflects Silver Fox’s broader expansion from earlier Chinese-speaking targets into Japan and other regions.
Jun 29, 2026
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026