Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India

0
Medium
Published: Thu Apr 30 2026 (04/30/2026, 09:42:51 UTC)
Source: AlienVault OTX General

Description

The Silver Fox threat group conducted phishing campaigns targeting organizations in Russia and India by impersonating tax authorities. These campaigns delivered a multi-stage infection chain involving a Rust-based loader (RustSL) that deployed the ValleyRAT backdoor. During investigation, a previously undocumented Python-based backdoor named ABCDoor was discovered, active since late 2024. ABCDoor enables remote control, screen broadcasting, and file manipulation. The attacks used sophisticated evasion techniques such as geofencing, string encryption, and mimicking legitimate VPN services. Over 1600 malicious emails targeted sectors including industrial, consulting, retail, and transportation. No known exploits in the wild or patches are available. The threat is assessed as medium severity.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 05/04/2026, 11:06:22 UTC

Technical Analysis

Silver Fox employed phishing campaigns in late 2025 and early 2026 targeting organizations in Russia and India by impersonating tax authorities. The attack chain involved a modified RustSL loader written in Rust that deployed the ValleyRAT backdoor. A newly identified Python-based backdoor named ABCDoor was found, which has been active since late 2024. ABCDoor provides remote control capabilities, screen broadcasting via ffmpeg, and file manipulation functions. The group used multi-stage infection chains with encrypted payloads, custom ValleyRAT modules, and persistence techniques including Phantom Persistence. Evasion methods included geofencing, string encryption, and mimicking legitimate VPN services. The campaigns targeted multiple sectors with over 1600 malicious emails sent. There is no vendor patch or fix available, and no known exploits in the wild have been reported.

Potential Impact

The threat enables attackers to remotely control infected systems, broadcast screens, and manipulate files, potentially leading to espionage, data theft, or disruption within targeted organizations. The use of sophisticated evasion and persistence techniques increases the difficulty of detection and removal. The targeting of critical sectors such as industrial, consulting, retail, and transportation in Russia and India indicates a focused espionage or disruption campaign. No direct evidence of exploitation beyond phishing delivery and backdoor deployment is provided.

Mitigation Recommendations

No official patch or remediation is available for the ABCDoor or ValleyRAT backdoors. Organizations should focus on detecting and blocking phishing emails impersonating tax authorities, especially those containing archives or suspicious attachments. Monitoring for indicators of compromise related to RustSL loaders, ValleyRAT modules, and ABCDoor behaviors may help identify infections. Since the threat uses sophisticated evasion techniques, endpoint detection and response solutions with behavioral analysis capabilities are recommended. Vendor advisories do not indicate any 'no action required' status; therefore, proactive detection and response are advised.

Affected Countries

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Author
AlienVault
Tlp
white
References
["https://securelist.com/silver-fox-tax-notification-campaign/119575/"]
Adversary
Silver Fox
Pulse Id
69f3241b2759ee934874df9f
Threat Score
null

Indicators of Compromise

Domain

ValueDescriptionCopy
domainobfuscate.io
domainabc.doublemobile.com
domainguard.rs
domainipv4.rs
domainmcagov.cc
domainroldco.com
domainsteganography.rs
domainsudsmama.com
domainuuid.rs
domainabc.3mkorealtd.com
domainabc.fetish-friends.com
domainabc.haijing88.com
domainabc.ilptour.com
domainabc.petitechanson.com
domainabc.sudsmama.com
domainabc.woopami.com
domainvnc.kcii2.com

Ip

ValueDescriptionCopy
ip207.56.138.28
ip108.187.37.85
ip154.82.81.205
ip108.187.42.63
ip108.187.41.221
ip192.163.167.14
ip45.192.219.60
ip154.82.81.192
ip192.229.115.229
ip192.238.205.47
ip207.56.119.216
ip57.133.212.106

Hash

ValueDescriptionCopy
hash3296bd88e0a85ebad4f429878bf8bca16ac43e609133b4781f88a339c37bfe9f
hash4fc5ec1de89ce3fcdd3e70db4a9c39d1
hash70ae9ca2a285da9005a8acb32dd31ace
hash1d28c9073fb89c09cd34ea3592d6654832e45a14
hashfd4dba4c4493e6fe3045f9e47f63b6f8b256ac32
hash4518249127a023adb81d232452395e1506a3766eac1664b8a63c3d0e7dcc2dc2
hash4b4dcbd26f08dca7e3e5721f0f5bdc6274e1edc0556e0749a426ec22ff83ca10
hash949b0bea5bd7feab58e280dde49310521920b655714c5f1b7d9de8719373dcd7
hashb0e06925db5416dfc90babf46402cd6f
hasha00e86ee1c4a1318ae394d3927d01f5aec74f861
hashf0e4d25b9b707be029e915ecb9fe61132cce89e138de36fef5e1edef551d7c25
hash2c5a1dd4cb53287fe0ed14e0b7b7b1b7
hash3c6aec25ebb2d51e1f16c2eef181c82a
hash25818cdcfb39eaa22d999d214e6159417cfba72e
hashbb88f63ba7762b7307251ab0e8bb544ccbaf9b52
hash5d8c7fffc0992639edbca893366f19d5784af2d77e3cfcbaa445a10c503f935a
hash795f939f8b9a2d56a3e8a609cab81032d9122a7d56ea852d95cd668f09139a3a
hash70016ddbcb8543bdb06e0f8c509ee980
hash8fc911ca37f9f451a213b967f016f1f8
hashdd0114ffacc6610b5a4a1cb0e79624cc
hash0e8c2c75d3dd4b670b8d035d5f645c74f5455c02
hash34d7aa9cf1fceab7f221891f7fbc23157bd9f65b
hash9a6c59eaa1d467029c8e1fee651b6d09ddde91e4
hash5be9fc4ad9ae3e791d18427f4592c234dfb612aec39b219e8ec57424f61cbab3
hash905efac09785631ed57e57a6236b87c04f53b9e0a3bf697df71365814dee6362
hashdbfa683cd8c600ed0e90f58eb965ca38b1561fa99d12cb7f252e8608da217df2
hash67c87dafb26de3b2b15b93a4ccd291e95682b9adf4ecb083b7c54286245ebd87
hash44299a368000ae1ee9e9e584377b8757
hasha0d1223ca4327aa5f7674bda8779323f
hash895aebe2d281e66f87963c01de570286561a0de2
hash96ea4a649f67272e305b75401a4045efae91c926
hash1d1f71936db05f67765f442feb95f3fd
hashd1d78cd1436991adb9c005cc7c6b5b98
hash039e93b98ef5e329f8666a424237ae73
hash04194f8ddd0518fd8005f0e87ae96335
hash043e457726f1bbb6046cb0c9869dbd7d
hash06130dc648621e93acb9efb9fabb9651
hash0b9b420e3edd2ade5edc44f60ca745a2
hash0c3b60ffc4ea9ccce744bfa03b1a3556
hash1020497bef56f4181aefb7a0a9873fb4
hash11705121f64fa36f1e9d7e59867b0724
hash13669b8f2bd0af53a3fe9ac0490499e5
hash1aa72cd19e37570e14d898dff3f2e380
hash202a5bcb87c34993318cfa3fa0c7ecb0
hash2375193669e243e830ef5794226352e7
hash27a3c439308f5c4956d77e23e1aad1a9
hash2b92e125184469a0c3740abcaa10350c
hash32407207e9e9a0948d167dca96c41d1a
hash3279307508f3e5fb3a2420dec645f583
hash3417b9cf7acb22fae9e24603d4de1194
hash4a5195a38a458cdd2c1b5ab13af3b393
hash4d343515f4c87b9a2ffd2f46665d2d57
hash4fc8c78516a8c2130286429686e200ed
hash5390e8bf7131caaaa98a5dd63e27b2bc
hash53b68ca8d7a54c15700cf9500ae4a4e2
hash5b998a5bc5ad1c550564294034d4a62c
hash5ed84b2099e220d645934e1fd552ae3a
hash6495c409b59deb72cfcb2b2da983b3bb
hash6611e902945e97a1b27f322a50566d48
hash6cf382d3a0eae57b8baaa263e4ed8d00
hash79cd56fc9abf294b9ba8751e618ec642
hash7f27818e4244310a645984ccc41ea818
hash814032eec3bc31643f8faa4234d0e049
hash84e54c3602d8240ed905b07217c451cd
hash891de2ff486a1824f2db01c1bdf1d2e9
hash8ac5bee89436b29f9817e434507fef55
hash90257aa1e7c9118055c09d4a978d4bee
hash933f1cb8ed2ced5d0dd2877c5ea374e8
hash9bf9f635019494c4b70fb0a7c0fb53e4
hasha083c546dc66b0f2a5e0e2e68032f62c
hasha234850dfdfd7ee128f648f9750dd2c4
hasha543b96b0938de798dd4f683dd92a94a
hasha75713f0310e74ffd24d91e5731c4d31
hashad39a5790b79178d02ac739099b8e1f4
hashb23d302b7f23453c98c11ca7b2e4616e
hashb500e0a8c87dffe6f20c6e067b51afbf
hashb53e3cc11947e5645dfbb19934b69833
hashb5ca812843570dcf8e7f35cacab36d4a
hashb6df7c59756ab655ca752b8a1b20cffa
hashc50c980d3f4b7ed970f083b0d37a6a6a
hashcb3d86e3ec2736ee1c883706fca172f8
hashd17caf6f5d6ba3393a3a865d1c43c3d2
hashde8f0008b15f2404f721f76fac34456a
hashdfc64dd9d8f776ca5440c35fef5d406e
hashe5e8ef65b4d265bd5fb77fe165131c2f
hashe6362a81991323e198a463a8ce255533
hashe66bae6e8621db2a835fa6721c3e5bbe
hasheefc28e9f2c0c0592af186be8e3570d2
hashf15a67899cfe4decff76d4cd1677c254
hashf7037cc9a5659d5a1f68e88582242375
hashf8371097121549feb21e3bcc2eeea522
hashfa08b243f12e31940b8b4b82d3498804
hashfc546acf1735127db05fb5bc354093e0
hash0ac6b8a5f0572b82f6483f2dff2d1535e3da55f0
hash0dc9684946142d231f75ed2c9ce1f7ebc38b39f4
hash12e41cc25fe8e99a0fca691fb88ed9823e989853
hash2c2ebe8f78f1a4143e6a125adb7a4efd2aebc275
hash34d792d07092d963375e336869c9f40296858345
hash38a03f625cd9de3086a7ea6759c0b46115a0525b
hash8c29a2693ddf208455db290abfc76c153da27643
hashacbdc1781a5a62789fdd233cde9c6521500f66f2
hashad94d5ee63f405eb6a1a157713aa6999e579c6e6
hashca5c6fc9d9adc8e8edd474f601429764cc52d4b0
hashf4d105f9565a8ee98e94d92e5a516e2f7b86e343
hash0cffb8b8fd11f300b5477ff23ec576f66ab65c021d995fa5495827237e679d93
hash0eb664b45200c9b4e954162128d2c13bc693f6ae57650b49a3a9fb9b2e821110
hash285c764e84ca830d90e75df06ee5445693f79058142b85b5e054c5c78c0421aa
hash56366c635d7b2ae88e8c8e9511f0c12e1cf1173b8be8c8f211b38a26d3a21e1c
hasha553833771f3e75ec3132f1295284e0e885e048b288f37ff8546677e5cb42f2f
hashc925048d6da2a2cd30ad521c1153f56366ee4bacbe84c8b929c1be7f9f2aa445
hashd8f9f8bc811f428dd9605000470c5f496f46145e2d3d8b7e750bca901e55fcdd
hashe96091fd784eca3c56ce4a703b22f5e5941464aec32a6f356ad0f99ea4422f04
hashfedf8678350dd29713be43f6115a2a8361f011b4b2eaf51e57eb2ffd758caa83
hashffaea868dc1d68211664133e3b69f7025f1406bd4647d77f3aee945d745ad4bc

Url

ValueDescriptionCopy
urlhttp://154.82.81.205/YD20251001143052.zip
urlhttp://154.82.81.205/YD20251001143052.zip'
urlhttp://154.82.81.205/YN20250923193706.zip.
urlhttps://abc.fetish-friends.com/setup/install
urlhttps://abc.fetish-friends.com/setup/install?channel=dianhua-0903
urlhttps://abc.fetish-friends.com/setup/install?channel=whatsapp_0826
urlhttps://abc.fetish-friends.com/setup?channel=jiqi_0819
urlhttps://abc.fetish-friends.com/uploads/appclient.zip
urlhttps://mcagov.cc/download.php?type=exe.
urlhttps://roldco.com/api/download/c51bbd17-ef08-4d6c-ab4c-d7bf49483dd6
urlhttps://sudsmama.com/api/download/50e24b3a-8662-4d2f-9837-8cc62aa8f697
urlhttps://sudsmama.com/api/download/c8ea0a2c-42c2-4159-9337-ee774ed5e7cb
urlhttps://vnc.kcii2.com

Threat ID: 69f87a33cbff5d861007009c

Added to database: 5/4/2026, 10:51:31 AM

Last enriched: 5/4/2026, 11:06:22 AM

Last updated: 5/4/2026, 1:39:50 PM

Views: 4

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses