Beyond ValleyRAT: inside a China-nexus Silver Fox operation

1. Executive summary

We investigated an operation, seen from August to October 2026, that spread the Windows backdoor ValleyRAT. We analysed 44 loader builds and decrypted every configuration. Twenty-five, which call five command and control (C2) servers, make up the operation. In the August and September packages we examined, a genuine signed program, usually renamed with a tax number, side-loads the loader. Twelve of the 44 builds carry the U.S. Department of Homeland Security seal, the icon of a blank Spanish-language shell program around the malware; the loader never displays it.

Three of the operation's four C2 domains share one registrant name. One file-sharing website served three operation builds and two other C2 servers' loaders. It once shared the IP address 103.23.172[.]117 with domains of a Gname registrar account that registered fake Indian tax page domains and two domains in Silver Fox reports. We judge it very likely that the operation belongs to Silver Fox, the name vendors give to ValleyRAT activity they place in China. Confidence is moderate, because it rests on that IP address, shared on one day, and one tax page linking to that website. Defenders should apply our indicators and hunt for unsigned DLLs beside renamed signed programs.

Key findings

The file-sharing site kaiwyrey[.]eu[.]cc, which we call the delivery host, delivered three of the operation's 25 loader builds. Over time it served loaders for three C2 servers in turn. The earliest loaders called auk218[.]club, and the three operation builds called the operation's C2 IP address, 192.252.183[.]157. The latest loaders called fddlbh2[.]club, a domain that was later pointed to the same IP address. We judge it likely that whoever controls 192.252.183[.]157 also controls fddlbh2[.]club. Confidence is low, because a delivery service with several customers would leave the same evidence.

We assess it very likely that four C2 domains share one set of registration details at the Chinese registrar 22net, with the registrant organisation KANGYINGJIE. Three of them, taku788[.]club, fuoe333[.]club and moik77a[.]club, belong to the operation, while the fourth, fddlbh2[.]club, lies outside it. Confidence is moderate. Historical copies of the registration records replace each contact value except the country with a hashed value, so a given name always gives the same one. For the registrant organisation, all four domains carry the same hashed value, ab376f4f34801a68. Our own records show the name KANGYINGJIE for the first three; for fddlbh2[.]club they show only the hashed value, and the name appears in a stored copy of its record dated 2026-09-06.

Account 574849-1923 at the registrar Gname registered two domains that appear in Sekoia's and JUMPSEC's Silver Fox reports. Two observations, both from before the first loader package we analysed on the delivery host, tie the account to it. On 2026-06-30 the delivery host and two of the account's domains shared one IP address, 103.23.172[.]117. Then, on 2026-07-31, the account's tax page kcsueaw[.]xin linked to the delivery host. We judge it likely that the delivery host and the account's domains have one controller, whether a single operator or a service working for several customers. Confidence is low, because each observation is a single event.

Figure 1 shows how our evidence connects this operation to domains that Sekoia [1], JUMPSEC [2], CloudSEK [7] and Proofpoint [11] published. The connection to aeya388[.]club, the C2 domain in Proofpoint's report, is a shared registrant name only.

Colours and lines in Figure 1:

• navy: the operation
• steel blue: our findings
• grey: other vendors' reports
• gold: the two kinds of evidence our attribution rests on (the operator's choices and the registrar account) and the lines that carry them
• dashed line: a connection through a registrant name only

Names used in this report

Table 1 explains the names this report uses.

Table 1: Names used in this report.

What is new in this operation

Table 2 sets what this operation shows against earlier public reporting.

Table 2: What is new in this operation, against earlier public reporting.

Notes to Table 2:

• "None found" means that our searches of published reports and researcher posts found no earlier description.

2. Scope and method

Our subject is one ValleyRAT operation, which we followed from August to mid October 2026. It takes in every build we hold that calls one of five C2 servers, plus the packages that delivered those builds.

The period starts on 2026-08-09, the day fuoe333[.]club was registered as the first of the operation's C2 domains. It ends with our last observation, on 2026-10-14. The research began with one file from the VMRay UniqueSignal Threat Intelligence feed. That file, B1, is a library that poses as NVIDIA Telemetry. It is one of nine x86 builds we obtained as standalone files (B1 to B9). Between them, these nine call the five C2 servers that define the operation:

• taku788[.]club
• fuoe333[.]club
• moik77a[.]club
• usdt888[.]club
• 192.252.183[.]157

Of the 44 builds we analysed, 25 call these five servers and the other 19 do not. Table 3 splits them by C2 server and by how we obtained them.

Table 3: The 44 builds by C2 server and by how we obtained them.

Figure 2 places the builds, servers and registrations in time. It also shows 25 re-packed files that carry the seal icon, which we first saw from 2026-10-05; 17 of them contacted usdt888[.]club. They are not among our 44 builds, and they are packed with Themida or Enigma, commercial protectors that hide a program's code until it runs (Annex section A3.2).

The companion technical annex, ChinaNexus_SilverFox_ValleyRAT_Technical_Annex_TLP-CLEAR.pdf, holds the supporting detail.

3. The kit and how it reaches victims

All 44 loader builds we analysed come from one toolkit, the HDP loader kit. It hides its loaders behind genuine signed programs and gives every build its own configuration key. Twelve builds also carry a U.S. government seal as their main icon; it is the icon of the blank starter program in which the kit hides its malicious code.

3.1 How the loaders reach victims

The loaders hide behind genuine signed programs through DLL side-loading, so they run inside a trusted process. In the August and September delivery packages we examined (Annex Table 2), the signed program is renamed in one of two ways:

• with a number, most often a tax number
• after CERT-In, India's computer emergency response team, as in CERT-In5605112305.EXE

The signed program and the loader sit inside a disk image (VHDX, ISO or VHD), often in a ZIP. No package held a decoy document. The loader downloads the ValleyRAT core, the main backdoor program, from its C2 server. It keeps the core in the registry under HKCU\\Console\\0, a form of fileless storage (Figure 3), and persists through a scheduled task. The August builds whose resources we decrypted also carry two embedded kernel drivers (Annex sections A3.5 and A3.6).

One package, which carries B4, shows the pattern:

• the signed program hxdaemonprocess.exe, from the Chinese stock trading software maker Hithink RoyalFlush, loads the loader hdp.dll
• in the package Tax-Number852694.zip, the program is renamed INT-Number.20260820113657.EXE; the digits in that name give the time the package was made, at UTC+8 (section 4.2)

Each package pairs two kinds of file: a genuine program signed by a software company, and the malicious loader that it starts. Every loader we have is unsigned (Annex Table 7). The signatures on the genuine programs are real and do not mean the companies are involved. In the packages we hold, five companies signed these programs, four of them Chinese and one Taiwanese:

• Chinese: Guangzhou Ningjinghai (signer of an Alibaba crash reporter), Hithink RoyalFlush, Hangzhou Fencha (signer of a ShadowBot program) and Tencent
• Taiwanese: ZEON Corporation of Taipei, whose PDF tool ConvertToPDF.exe appears only outside the operation. The auk218[.]club packages pair it with a loader named pdfCoRe8.DLL, the same pair that Cato Networks reports from a Silver Fox intrusion in Japan [14]

3.2 The builds and the keys they carry

Each loader carries a configuration: a block of settings, encrypted with RC4 under its own key, that includes its C2 server. All 44 configurations share one field layout. The ValleyRAT builder, public since March 2025 [3], writes each configuration into a precompiled loader stub (Annex section A5.2). As a result, every user of a builder release gets the same compiled code. Builds that look alike, or share a compile time, are therefore no evidence of one operator; the configurations are what tell builds apart. For example, six builds (B1 to B6) were all compiled at 12:39:19 UTC on 2026-08-19. Their configurations still call five different C2 servers.

Each configuration starts with a pipe character and its group ID, a ValleyRAT field that holds a 19-character identifier. No group ID repeats across the 44 builds, so in our set each identifies a single build. The group ID is stored in clear text. Written backwards, it is the RC4 key that decrypts the rest of the configuration, so anyone holding an unpacked build can decrypt it offline.

3.3 The U.S. Department of Homeland Security seal

Twelve of our 44 builds carry the seal of the U.S. Department of Homeland Security (DHS) as their main icon. Each loader file is a blank starter program, the default application that Microsoft Visual Studio generates, with the kit's encrypted malicious code added inside it. The starter program does nothing harmful on its own; it only makes the file look like ordinary software. The seal is that starter program's icon, and the loader never shows it.

The twelve are the builds compiled from 2026-08-13 to 2026-08-19. The cover application comes in a Spanish version and five Chinese ones: the twelve carry the Spanish one, while the other 32 builds, compiled before and after those dates, carry Chinese ones. Mentioning the seal implies no involvement or endorsement by DHS.

We assess it almost certain that the seal is the main icon of the Spanish cover application itself. Confidence is high. On 2026-10-14 we found 170 files whose main icon is the seal, far more than the twelve builds of ours that carry it. We analysed 47 of those 170 in detail, and all 47 carry the Spanish cover application. A Windows program file can store several sets of icons, and the first set is the one shown as the file's icon. In B4 the seal is in that first set (Figure 4, Annex section A3.8).

We judge it almost certain that the side-loaded loader never loads or displays the seal. Confidence is high, for two reasons: the code that runs never calls a function that loads an icon, and nine VMRay run logs of the six builds B1 to B6 record no lookup of an icon resource (Annex section A3.8).

Annex Table 8 gives a likelihood for each of five possible reasons for the seal. Two reasons are each a roughly even chance. Either the seal came in a pack of icons and other resources that the kit's author ships with the kit, or it is a test or placeholder. It is unlikely that the seal is left over from an earlier US-themed use of the cover application. In the builds we analysed it is very unlikely to be a decoy for a later DHS-themed lure, and very unlikely to be an icon meant to look official to victims. Our confidence in this last reason is moderate, because victims never see the seal on the delivery paths we observed. Our confidence in the other four is low.

4. One delivery host, three C2 servers over time

Three of the operation's four C2 domains share one registrant name. One file-sharing website, the delivery host, served three of the operation's builds. Before and after them, it served loaders for two other C2 servers. The later of these is a domain that was pointed at the operation's C2 IP address. We judge it likely that one party controls that domain and the operation's C2 IP address. Confidence is low.

4.1 The C2 servers and who registered them

The 44 builds call eight C2 servers: seven domains and one IP address (Table 4). We assess it very likely that four of these domains were registered at 22net under one set of details. The details are the registrant organisation KANGYINGJIE (Figure 5) and the province BEIJINGSHI (Beijing). Three of them are the operation's taku788[.]club, fuoe333[.]club and moik77a[.]club, and the fourth, fddlbh2[.]club, is outside the operation. Confidence is moderate. Historical copies of the registration records replace each of these details with a hashed value, and all four domains share the same hashed values. The organisation's code is a hashed value (notes to Table 4). Our own records show the name KANGYINGJIE for the three operation domains, and taku788[.]club's record also gives the province BEIJINGSHI. For fddlbh2[.]club the name appears in a stored copy of its record (Table 4, note a).

A second, older set of KANGYINGJIE details gives the province ANHUISHENG (Anhui), so a shared name alone does not show a shared owner. aeya388[.]club, a C2 domain in Proofpoint's report [11], carries these older details.

Table 4: The C2 servers that the 44 builds call.

Notes to Table 4:

• The first five rows are the operation's C2 servers, called by 25 builds; the other 19 builds call the servers in the last three rows.
• taku788[.]club, fuoe333[.]club, moik77a[.]club and fddlbh2[.]club share the hashed value ab376f4f34801a68.
• (a) Our own records show only the hashed value. A stored copy of the registration record, dated 2026-09-06, shows the name.
• Annex Table 9 lists the builds behind each count.

usdt888[.]club is in the operation because two of the nine standalone builds, B5 and B6, call it (section 2). It is registered under a different registrant name, ZHENGJUNHUA, with its own hashed value. The two registrant names share only the registrar 22net, a province code and Indian tax themed domains. Since all of these are common choices, they do not show a shared owner. Builds that call domains under either name also share toolkit traits such as a compile time, but such traits are no evidence of one operator (section 3.2; Annex sections A4.8 and A5.5).

4.2 The delivery host's uploader account and its package time stamps

The delivery host served loaders for three C2 servers, and the way its download links behaved suggests that a single uploader account placed all of them. Most of its package time stamps fall in weekday office hours in a UTC+8 time zone. The delivery host runs a file-sharing web application with user accounts and download links:

• its domain, kaiwyrey[.]eu[.]cc, created at the registrar Gname on 2026-06-29
• its download links, of the form hxxps://kaiwyrey[.]eu[.]cc/d/ followed by twelve hex characters

Of the delivery host's 48 download links on record, Annex section A4.2 names the four main ones. From 2026-08-03 these four nearly always served the same file as one another. When two different links were recorded within three minutes of each other, both served the same file in 45 of 46 cases. At any one time the links served one file, but that file was swapped over time, sometimes within minutes. From 2026-08-20 to 2026-08-29 the links alternated between the packages of two operation builds, C17 and B4. We judge it very likely that one uploader account on the delivery host uploaded the loaders for all three C2 servers. Confidence is moderate, because we infer the account from how the links behaved. A delivery service running one account for several customers would leave the same pattern.

The delivery host's packages fall into three periods, and the loaders we analysed from each period call a different C2 server (Figure 6, Annex Table 11):

• auk218[.]club, outside the operation: 2026-08-03 to 2026-08-13
• 192.252.183[.]157, in the operation: 2026-08-17 to 2026-08-31
• fddlbh2[.]club, outside the operation: 2026-09-02 to 2026-09-06

We read one packing time stamp from each of 33 delivery host packages, in its file name or its disk image file times. We read all 33 as UTC+8 local time, eight hours ahead of UTC. The delivery host's August ISO disk image files we analysed store their file times at that offset. At that offset, the time in the renamed program name INT-Number.20260820113657.EXE matches the file times inside its disk image file. Of the 33 time stamps, 27 fall on a weekday between 10:00 and 17:00 at UTC+8. These 27 include all three time stamps on the operation's packages. We assess it likely that whoever made the packages works a weekday office schedule in a UTC+8 time zone. That time zone covers China, Taiwan and Singapore among other places. Confidence is moderate, because the schedule rests on 33 time stamps from one delivery host (Annex section A6.4).

4.3 Who controls fddlbh2[.]club

We judge it likely that one party controls both the operation's C2 IP address, 192.252.183[.]157, and the C2 domain fddlbh2[.]club. B4, C15 and C17 call that IP address, and the delivery host served loaders for fddlbh2[.]club next, after theirs. Confidence is low, because a service running the delivery host for several customers would also explain this connection.

B4's package, Tax-Number852694.zip, was last recorded on the delivery host at 22:40 UTC on 2026-08-31. About 13.5 hours later, at 12:15 UTC the next day, fddlbh2[.]club was registered. The domain's zone (SOA) serial is a version number that changes whenever its DNS records are edited. If that serial records the time of the last edit, the domain was pointed to 192.252.183[.]157 at 12:30 UTC (Annex Table 13). The next day, 2026-09-02, the download link that had served B4's package served F1, a 64-bit build that calls fddlbh2[.]club (Figure 7).

fddlbh2[.]club and B4 therefore share two details within days: the C2 IP address and the delivery host. The C2 IP address and the delivery host run at different providers, so they are two separate shared values. The main alternative is a service that runs C2 servers on 192.252.183[.]157 and runs the delivery host for several customers; such a service would produce the same two details. That alternative fits less well with the one registration lookup listing for auk218[.]club, the first C2 domain we found in the delivery host's packages. The listing shows it under KANGYINGJIE, and a stored copy of the registration record of fddlbh2[.]club, the last C2 domain in those packages, gives the same name. For a service with several customers, that shared name would be a coincidence. An unrelated user of the public ValleyRAT builder fits even less well, because that user would have had to pick the same IP address and delivery host within days.

5. The registrar account and its tax lures

One registrar account registered both the domains of the Indian tax lure pages and two domains that vendors tie to Silver Fox. Two separate observations link the account to the delivery host, and each is a single event. We therefore judge it likely that one party runs the account and the delivery host. Confidence is low.

5.1 The delivery host's IP address range

Three kinds of host sat, at different times, in the IP address range 103.23.172[.]0/24: the delivery host, the registrar account's Indian tax lure pages and eleven phishing host names that Sekoia lists as Silver Fox [1]. The range matters mainly because it holds 103.23.172[.]117, the IP address that the delivery host shared with two of the registrar account's domains (section 5.2, Annex section A2). From July 2025 to October 2026 the range hosted at least 1,092 host names on 131 IP addresses (Figure 8). Sekoia gives no IP address in this range for the eleven names, which we first recorded there between January and June 2026.

Gold marks the delivery host and the phishing names that Sekoia lists as Silver Fox [1], together with the lines that join them to the IP addresses that hosted them.

5.2 How Gname account 574849-1923 connects to the delivery host

We assess it very likely that a single Gname customer controls the registrar account and all 243 of its domains (Figure 9). That customer either runs its own operation or hosts lures for others. Confidence is moderate, for two reasons: the account number, 574849-1923, appears as registrant, administrative and technical contact of all 243 domains, but on no other Gname domain in our records. Sekoia lists isyraw[.]quidoaehse[.]icu, a subdomain of the account's domain quidoaehse[.]icu, as Silver Fox phishing [1]. JUMPSEC lists the account's domain kjfuwyce[.]love as documented Silver Fox infrastructure [2].

Two observations connect the account to the delivery host. Both predate 2026-08-03, the date of the first loader package we analysed on the delivery host:

• On 2026-06-30 the delivery host and two of the account's domains were recorded on the IP address 103.23.172[.]117. By 2026-07-01 the delivery host had moved to 103.23.172[.]118.
• On 2026-07-31 kcsueaw[.]xin, one of the account's Indian tax lure pages, linked to one of the delivery host's download links.

These observations do not tie the account directly to the operation's loaders. We judge it likely that one party, either a single customer or a service working for several customers, controls both the account and the delivery host. Confidence is low, because the two observations are one IP address shared on one day and one link from one lure page.

5.3 The Indian tax lure pages

We assess it likely that some of the delivery host's tax-themed packages were aimed at Indian victims. Confidence is low, because only one name on the delivery host's packages, Tax PenaltyN0, points there, and the one Indian lure page that linked to the delivery host, kcsueaw[.]xin, did so before the first loader package we analysed there.

The registrar account registered all 18 lure page domains of July and August that we recorded, and the June lure page domains listed in Annex section A4.6 (Figure 9). Of the 18, 17 resolved to the IP address 103.23.172[.]15 (Figure 8).

Gold marks the account and its two domains in Silver Fox reports.

These are the two package or program names that point to India:

• Tax PenaltyN0, used on the delivery host's packages for auk218[.]club loaders, echoes the Hindi title of the Indian lure pages, translated "tax penalty notice, Government of India".
• CERT-In5605112305.EXE (Annex Table 2) names India's computer emergency response team, but it came in a September package for the operation's build B7 that the delivery host did not serve.

Two facts weaken this judgment. Value-added tax prefixes in package names, such as VATNo., are used in many countries, and the account also registered the domains of three hosts named after the Thai government, in the same IP address range (Figures 8 and 9).

6. Attribution

We judge it very likely that the operation belongs to the ValleyRAT activity that vendors group as Silver Fox. Confidence is moderate, because two independent kinds of evidence agree (section 6.1). Within Silver Fox we name no actor, team or sponsor.

6.1 Why we place the operation in Silver Fox

Two kinds of evidence support the judgment. The first, the operator's own choices, places the operation with Chinese-speaking ValleyRAT users. The second, the registrar account, is the only evidence that separates Silver Fox from other such users. The list below shows how closely the registrar account ties to each of the three groups of the operation's 25 builds:

• the three builds that call 192.252.183[.]157: through the delivery host
• the 20 builds that call the three C2 domains registered under KANGYINGJIE: only indirectly, because fddlbh2[.]club shares their registrant details, one registration lookup listing places auk218[.]club under KANGYINGJIE, and the delivery host served loaders for both (sections 4.1 and 4.3)
• the two builds that call usdt888[.]club: not at all, so the judgment is weakest for them

The operator made these choices; the public ValleyRAT builder does not make them for its users [3]:

• UTC+8 time stamps in weekday office hours on the delivery host's packages, including all three on the operation's own packages (section 4.2)
• signed programs from Chinese software companies, used to side-load the loaders even in packages with English tax names
• romanised Chinese registrant names at the Chinese registrar 22net

The main alternative is a Chinese-speaking user of the public builder whom no vendor places in Silver Fox. Such a user would make the same choices, so the choices alone cannot separate it from Silver Fox. The registrar account, however, has two domains in Silver Fox reporting. The alternative fits the account and those two domains only if a service ran Gname account 574849-1923 and the delivery host for several customers (section 5.2).

Other traits match public reporting but cannot establish the link, because any user of the public ValleyRAT builder would share them, and anyone can choose a lure theme (Annex section A6.1):

• the ValleyRAT core [3]
• the configuration fields [4] [11]
• the shape of the loader's exports [12]
• tax-themed packages, some likely aimed at India (section 5.3) [4] [6] [13]
• the kernel drivers and scheduled task of section 3.1 [5] [14] [15]

6.2 A Chinese-speaking operator in a UTC+8 time zone

On the evidence of the operator's choices in section 6.1, we assess it very likely that the operation runs from a Chinese-speaking environment in a UTC+8 time zone. Confidence is moderate, because any one of these choices can be copied.

Proofpoint published a TA4922 configuration that calls aeya388[.]club (section 4.1). The company describes TA4922 as a suspected Chinese crime group that overlaps with activity others call Silver Fox [11]. Nothing in our evidence separates crime from espionage, and nothing points to state tasking.

7. Indicators and what defenders should do

Defenders can block what our indicator file marks for blocking, hunt for the kit's traces on hosts and in file names, and decrypt new builds and C2 traffic offline.

The attached PDF ChinaNexus_SilverFox_ValleyRAT_Indicators_TLP-CLEAR.pdf lists all 1,391 defanged indicators in five tables:

• Table A: search keys, the registration values that connect records
• Table B: network indicators
• Table C: file indicators
• Table D: configuration and build values
• Table E: host artefacts

ChinaNexus_SilverFox_ValleyRAT_IOCs_TLP-CLEAR.csv gives the same values as one machine-readable list.

• Tables B and C of the indicator file mark the values that are safe to block as Block; block those. Match those marked Block (dated), which are rented or shared servers, only against traffic between the observation dates the table shows. Use values marked Hunt for searching logs and endpoints, not for blocking alone.
• Hunt for the registry value 389126097FFFEF316D35ACD0610E5F31 under HKCU\\Console\\0. The loader stores the packed ValleyRAT core in this value. The value's name was the same in all six VMRay runs of kit loaders in which a C2 server answered (Table E).
• Hunt for mutexes whose names start with a pipe character, |, and a build's 19-character group ID (section 3.2). The loader uses its decrypted configuration as its mutex name (Tables D and E).
• Rebuild hosts that hold the registry value or the scheduled task in Table E: the core gives remote control, and the August builds carry kernel drivers.
• Hunt for delivery archives whose names end in a 14-digit date and time and twelve hex characters, such as 20260902110114-0AFC3F174BAD.zip. In all 16 such names we recorded, the hex characters start the configuration key of the build inside (Table E).
• Hunt for the genuine signed programs marked Never block in Table C when they run from a mounted disk image or under a tax document name such as INT-Number.20260820113657.EXE. Look for an unsigned DLL beside them named like one of the libraries in Table E, such as hdp.dll. Do not block them: they are legitimate vendor files, and blocking them would also block the vendors' software.
• Decrypt the configurations of new builds and captured C2 traffic offline with the methods in sections A3.4 and A3.5 of the technical annex. They do not work on the 25 re-packed files from October, which commercial protectors pack.
• PDFChinaNexus_SilverFox_ValleyRAT_Indicators_TLP-CLEAR.pdf PDFChinaNexus_SilverFox_ValleyRAT_Technical_Annex_TLP-CLEAR.pdf CSVChinaNexus_SilverFox_ValleyRAT_IOCs_TLP-CLEAR.csv

8. References

1. [1] Sekoia, Pierre Le Bourhis and Coline C., "Silver Fox: The Only Tax Audit Where the Fine Print Installs Malware", 2026-03-24, Silver Fox: The only Tax Audit Where Fine Print Installs Malware (accessed 2026-10-16).
2. [2] JUMPSEC, Jack Lewis, "PAPERMILL: Tracking an Emerging China-Nexus Malware Factory", 2026-09-15, PAPERMILL: Tracking an Emerging China-Nexus Malware Factory | JUMPSEC (accessed 2026-10-16).
3. [3] Check Point Research, "Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits", 2025-12-10, Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits - Check Point Research (accessed 2026-10-16).
4. [4] CloudSEK, Prajwal Awasthi and Koushik Pal, "Silver Fox Targeting India Using Tax Themed Phishing Lures", 2025-12-24, Silver Fox Targeting India Using Tax Themed Phishing Lures | CloudSEK (accessed 2026-10-16).
5. [5] Check Point Research, "Chasing the Silver Fox: Cat & Mouse in Kernel Shadows", 2025-08-28, Chasing the Silver Fox: Cat & Mouse in Kernel Shadows - Check Point Research (accessed 2026-10-16).
6. [6] Kaspersky Securelist, Anton Kargin, Vladimir Gursky, Victoria Vlasova and Anna Lazaricheva, "Analyzing the Silver Fox tax campaign and the new ABCDoor backdoor", 2026-04-30, Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India (accessed 2026-10-16).
7. [7] CloudSEK, "Tax Season, Open Season: Phishing and Malware Campaigns Targeting Indian Taxpayers", 2026-07-30, Tax Season, Open Season: Phishing and Malware Campaigns Targeting Indian Taxpayers | CloudSEK (accessed 2026-10-18).
8. [8] AlienVault OTX, skocherhan, pulse "ValleyRat", 2026-08-24, LevelBlue - Open Threat Exchange (accessed 2026-10-20).
9. [9] ExpectedErr0r, reply on X naming fuoe333[.]club, in a thread under a post tagged #ValleyRAT, 2026-08-19, Mostly AFK on Twitter / X (accessed 2026-10-20).
10. [10] skocherhan, post on X listing Winos C2 servers, 2026-01-27, ܛܔܔܔܛܔܛܔܛ on Twitter / X (accessed 2026-10-18).
11. [11] Proofpoint Threat Research Team, "TA4922: The Suspected Chinese Crime Group is Going Global", 2026-06-03, TA4922: The Suspected Chinese Crime Group is Going Global | Proofpoint US (accessed 2026-10-16).
12. [12] 0xdelta, Operator 0x_OLYMPUS, "Technical Analysis: ValleyRAT Delivered via Trojanized DingTalk Downloader and NVIDIA DLL Sideloading", undated, Technical Analysis: ValleyRAT Delivered via Trojanized DingTalk Downloader and NVIDIA DLL Sideloading (accessed 2026-10-16).
13. [13] Foresiet, "Fake Tax Notice Campaign: ValleyRAT Loader Unmasked (Part II)", 2026-07-06, Fake Tax Notice Campaign: ValleyRAT Loader Unmasked (Part II) (accessed 2026-10-16).
14. [14] Cato Networks (Cato CTRL), Tomer Pugach, Guy Waizel, Zohar Buber, Idan Tarab and Shani Kurtzberg, "Cato CTRL Threat Research: SilverFox Evolves: Abuse of New Drivers and Trusted Software Hijacking Enable Remote Access with ValleyRAT in Japan", 2026-07-28, https://www.catonetworks.com/blog/cato-ctrl-silverfox-evolves/ (accessed 2026-10-31).
15. [15] Nextron Systems, Maurice Fielenbach, "Thor vs. Silver Fox: Uncovering and Defeating a Sophisticated ValleyRat Campaign", 2025-11-28, Thor vs. Silver Fox – Uncovering and Defeating a Sophisticated ValleyRat Campaign (accessed 2026-10-16).