Massive Winos 4.0 Campaigns Target Taiwan

A series of targeted phishing campaigns in Taiwan have been observed disseminating Winos 4.0 (ValleyRat) malware and associated plugins. The attacks exploit local business processes using themes like tax audits and e-invoices. The campaigns employ various techniques including malicious LNK files, DLL sideloading, and Bring Your Own Vulnerable Driver (BYOVD) attacks. The malware utilizes UAC bypassing, driver loading, and process termination to evade detection and disable security software. The attacks are attributed to a subgroup of the Silver Fox APT, showing sophisticated localization and evolving evasion techniques. The campaigns have been active since at least January 2026, using consistent infrastructure and development identifiers.

• Critical infrastructure orgs face heightened cyber risk from nation-state groups, AI threatsCampaign2026-10-13
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• RATatouille: Today's Special: Impersonating Companies in Korea, Payments in CryptocurrencyMalware2026-10-28
• Camera Management Software Compromise Leads to Malware DeploymentMalware2026-10-27
• How VBScript Malware Evades Detection Using Trusted Tools CopyMalware2026-10-27