Silver Fox Trojan

Silver Fox is a remote access trojan (RAT) family that has been continuously active against Chinese organisations in recent years. China's National Computer Virus Emergency Response Center (CVERC), in its advisory of 21 May 2026, lists "Silver Fox" alongside "You She", "Gudu Dadao" and "UTG-Q-1000" as names for the same threat. Its payload descends from Gh0st RAT, whose source code was released publicly in 2008; researchers outside China usually name it after the payload instead, as ValleyRAT or Winos 4.0, and from 2025 a related branch called HoldingHands RAT (also tracked as Gh0stBins) appeared as well. Trend Micro named the earlier cluster that delivered Winos 4.0 through MSI installers Void Arachne - a linked designation rather than a strict synonym for what "Silver Fox" denotes in Chinese usage.

Public accounts of when it started do not agree, so we label that openly. ThreatBook formally named "Silver Fox" in March 2023 after catching a campaign; most Chinese sources describe the family as active from 2022 (the "first seen" line in the fact box above follows that reading); some trace related "You She" activity back to around 2020. We could not verify the primary material behind any of these, so we say only that it has been active in recent years rather than asserting a first-seen year.

Start with what it is not: Silver Fox is not ransomware. It encrypts nothing, renames nothing, leaves no note and demands no ransom. What it wants is to stay on the machine - watching the screen, reading chat history, learning how expenses and payments get approved - and then, at the right moment, to impersonate an executive and have finance send a payment. Because it is quiet, many organisations learn about it only after the money has left: ThreatBook wrote in April 2026 that 93.19% of the attacked companies it studied had no awareness of the compromise beforehand.

The naming disagreement is worth understanding, because it changes how you reason about the threat. ThreatBook named "Silver Fox" in March 2023 after catching a campaign that delivered phishing trojans through instant messaging to finance, securities and education organisations, and by August 2023 characterised it as a widely decentralised criminal toolkit - available to any operator, with at least five associated gangs publicly disclosed at that point. Sangfor's Qianlimu security centre, in its November 2023 report, likewise described a "Silver Fox collective" rather than a single organisation and broke it into four gang clusters. 360's 2025 annual Silver Fox report (19 January 2026) counts more than twenty crews building and re-packing the malware, with new ones still joining, and tens of thousands of attacks on Chinese government and enterprise targets over the year. Check Point, Fortinet and Kaspersky, by contrast, generally describe Silver Fox as an organised threat group (an APT) and have tracked its expansion after 2025 into Taiwan, Japan and Malaysia, and from late 2025 into India and Russia. Both readings hold together: the tooling, the evasion service and the kernel-level capability are shared, while the people using them are several unrelated crews. The practical consequence is that you should not predict the next move from a single "group profile" - assess instead who took this machine and what they intend to monetise.

Scale. Huorong reported in January 2025 that victim devices were being counted in the tens of thousands per month. China's CNCERT advisory of 22 May 2026 analysed 439 high-fidelity phishing domains distributing Silver Fox that were registered between 6 February and 4 May 2026, of which 340 (77.4%) impersonated WPS and Chrome, with the suffixes .hl.cn (42.6%) and .com.cn (30.8%) dominating; monitoring from 8 April to 7 May 2026 found up to 26,000 compromised hosts inside China at once and 182,000 infected cumulatively. On the enforcement side, the Ministry of Public Security's cyber-security bureau published five prosecuted Silver Fox cases on 16 June 2026, with 63 suspects placed under criminal measures across Jilin, Hangzhou, Shandong, Guangdong and Jiaxing; summing the per-case figures the notice gives puts the total above 13.4 million yuan, the Jilin case alone accounting for more than 7 million and 27 of the suspects.

Here is where it connects to ransomware. 360's annual report lists delivering ransomware alongside impersonation transfers, QR-code fraud and cryptocurrency theft as Silver Fox's four revenue streams, and notes that these cases typically involve ransomware crews buying a Silver-Fox-type RAT to open the door. On 11 December 2025 the company documented a campaign that opened with a "complaint withdrawal" email: once the Silver Fox trojan landed, it went on to download and run LockBit 5.0 and encrypt the machine. So "we have Silver Fox" never means "we will not be encrypted". Silver Fox behaves like initial access, and encryption is one of the options that can follow - which is why ransomware risk has to be assessed as part of any Silver Fox response.

Start with how it arrived. The first question is always what this machine recently installed or opened: an encrypted archive shared into a newly created working group, named around disciplinary action, personnel notices, layoffs, compensation, audits or invoices; an icon showing a folder, shortcut or recycle bin over a .exe, .scr or .lnk extension; an installer for WPS, Chrome, Sunlogin, DeepSeek or Teams downloaded from a search result rather than the vendor's site - especially from a lookalike domain.

Host artefacts. A signed-binary-plus-unknown-DLL pair is the strongest signal: a legitimately signed program such as installer.exe or a2guard.exe loading an unexplained DLL from its own directory; unexpected exe, dll or dat files under C:\Program Files\Internet Explorer\ and C:\Windows\; a system service named UserDataSvc_ followed by random characters; scheduled tasks pointing at suspicious paths; newly installed assemblies in the .NET Global Assembly Cache with matching registry edits; anomalous memory injection and remote threads in explorer.exe, svchost.exe, ctfmon.exe, sihost.exe and rundll32.exe. Also look for legitimate remote-assistance and remote-control software that nobody remembers installing - Silver Fox uses these heavily as back doors, and antivirus will not flag them.

Failures of your own security tools are evidence too. Protection switching itself off, a batch of security processes exiting shortly after a driver loads, EDR telemetry going quiet, or firewall rules rewritten so samples cannot be uploaded all point at BYOVD and user-mode unhooking.

Network and account anomalies. CVERC records call-back patterns of the form http://[domain]:8880/ and http://[domain]:8880/getinstall64, and payloads are frequently hosted on public-cloud object storage to borrow its reputation. On the account side: WeChat or QQ contacts disappearing or appearing on their own, login alerts from unfamiliar locations, messages marked read that the user never opened, an unfamiliar "executive" inside the corporate messenger, banking or brokerage activity the account holder did not perform, and SMS verification codes arriving for actions nobody initiated.

The first layer is money, and it moves fast. Once the operators understand the approval chain and complete the impersonation, a transfer is often executed within tens of minutes and dispersed through layered accounts immediately afterwards. The five cases the Ministry of Public Security published in June 2026 total more than 13.4 million yuan, the largest single case exceeding 7 million. Earlier ministry notices on fraud against corporate accounting staff describe the same pattern: long dormancy, then action timed to a busy payment period. Whether funds can be recovered depends mainly on how fast the police are notified and the bank can freeze the route - a legal and financial process that technical work can evidence and support, and that nobody can promise an outcome for.

The second layer is accounts and identity. Live sessions and stored credentials for online banking, brokerage accounts, the corporate messenger, WeChat, QQ, mail and OA may all be under someone else's control, and SMS codes can be intercepted, which means second-factor confirmation is no longer trustworthy. Worse, once the company's identity is being worn by someone else, the attack travels along the contact list to customers, suppliers and peers, so one compromise can become several organisations' incident, with the legal and reputational cost that implies.

The third layer is data. Tax and finance documents, payroll, contracts, customer lists and chat archives are packaged, exfiltrated and resold to downstream fraud crews. This loss does not show up immediately, but it keeps working against you.

The fourth layer is encryption risk. Silver Fox encrypts nothing itself, but it hands an attacker a fully controlled Windows endpoint. In the campaign 360 published in December 2025, the trojan went on to download and execute LockBit 5.0. If that endpoint belongs to finance or IT operations, holds server credentials or has mapped network drives, the blast radius can extend from one workstation to file servers, ERP and databases. A Silver Fox incident therefore has to be classified as an initial-access event, not as "one PC caught a virus".