Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India

The Silver Fox threat group conducted phishing campaigns in December 2025 and January 2026, impersonating tax authorities in India and Russia. Malicious emails contained archives with a modified Rust-based RustSL loader that deployed ValleyRAT backdoor. Over 1600 malicious emails targeted organizations across industrial, consulting, retail, and transportation sectors. During investigation, a previously undocumented Python-based backdoor named ABCDoor was discovered, active since late 2024. The attacks utilized multi-stage infection chains involving encrypted payloads, custom ValleyRAT modules, and various persistence mechanisms including Phantom Persistence technique. ABCDoor features remote control capabilities, screen broadcasting using ffmpeg, and file manipulation functions. The group employed sophisticated evasion techniques including geofencing, string encryption, and mimicking legitimate VPN services.

• Massive Winos 4.0 Campaigns Target TaiwanMalware2026-02-22
• RATatouille: Today's Special: Impersonating Companies in Korea, Payments in CryptocurrencyMalware2026-10-28
• Fake Software Installers Disable Windows Update and Weaken Microsoft DefenderMalware2026-09-03
• Counterfeit installers to system compromise: Tracking a deceptive software download campaignCampaign2026-09-02
• ValleyRAT is spreading disguised as adwareMalware2026-08-31