Silver Fox Uses Fake Tax Notices to Drop ValleyRAT and ABCDoor Backdoor

Silver Fox is running a tax‑themed phishing campaign that abuses fake notices from Indian and Russian tax authorities to drop ValleyRAT and a new Python backdoor dubbed ABCDoor, using a customized RustSL loader to evade detection and enforce strict geofencing controls.

The campaign shows how the group is steadily evolving from commodity RAT delivery to a modular, multi‑stage toolset that blends public tooling with custom implants.

The lures posed as urgent tax audit notices or “lists of tax violations,” pressuring recipients to open attached archives or follow embedded links.

In December 2025, Silver Fox sent malicious emails impersonating India’s Income Tax Department, followed by a near‑identical wave against Russian organizations in January 2026.

Across both waves, more than 1,600 malicious emails were recorded between early January and early February 2026, primarily hitting industrial, consulting, retail, and transportation companies.

Telemetry shows activity centered in India, Russia, and Indonesia, consistent with Silver Fox’s historical focus on Asia and expanding operations in South Asia.

Silver Fox Uses Fake Tax Notices

During this campaign, analysts identified a new ValleyRAT plugin that acts as a loader for a previously undocumented Python backdoor named ABCDoor.

The emails used two main delivery patterns: direct attachments and PDFs containing download links to attacker‑controlled sites.

In Russia, victims received PDFs with multiple clickable links that redirected to a ZIP archive on a malicious domain. At the same time, Indian targets were sent RAR attachments masquerading as official tax documents.

Inside these archives, victims encountered an executable with a PDF‑style icon – a modified version of the Rust‑based RustSL loader sourced from a public GitHub repository advertised as an “antivirus bypass framework” with multiple payload encryption, allocation, and execution options.

Silver Fox’s fork, referred to as Silver Fox RustSL, adds a new steganography.rs module to unpack encrypted payloads and a guard.rs module to enforce geofencing and environment checks.

Silver Fox switched from downloading payloads at runtime to bundling them alongside the loader as standalone files with benign‑looking extensions such as PNG, HTM, or XLSX, each containing an encrypted payload wrapped between custom markers and protected by a multi‑pass XOR scheme.

The loader validates decryption by comparing the resulting SHA‑256 hash with an embedded reference value, aborting if they differ, which complicates static tampering and analysis.

Additionally, in late December, emails were distributed with an attachment titled GST.pdf containing two links leading to hxxps://abc.haijing88[.]com/uploads/印度邮箱/CBDT.rar. 

Guard. rs performs extensive environment and country checks, calling several public IP‑geolocation services before allowing execution in specific countries, including India, Russia, Indonesia, South Africa, and later Japan.

This geofencing both aligns with Silver Fox’s targeting priorities and reduces exposure in non‑target regions where defenders might more quickly detect and share indicators.

From early January 2026, some Silver Fox RustSL builds began using the recently documented Phantom Persistence technique to survive reboots by hijacking Windows shutdown logic and forcing a restart that relaunches the loader on startup.

This method abuses legitimate restart APIs and shutdown parameters, making persistence appear similar to a standard application update rather than explicit malware autorun behavior.

Once executed, the decrypted shellcode stage pulls an encrypted ValleyRAT (also known as Winos 4.0) module from attacker infrastructure and then loads its core Login module to establish C2 connectivity, execute commands, and retrieve additional plugins.

Configuration data embedded at the end of the shellcode defines multiple C2 endpoints and operational parameters, allowing the actor to fail over between servers if one is blocked.

ABCDoor: the new Python backdoor

Retrospective analysis shows that ABCDoor has been in Silver Fox’s toolkit since late 2024 and has seen active use in attacks since early 2025.

According to our telemetry, users in all of these countries – with the exception of Cambodia – have encountered RustSL. The highest number of attacks in India, Russia, and Indonesia.

ABCDoor is packaged as a self‑contained Python environment with dependencies and a legitimate ffmpeg binary, deployed under a directory mimicking the Tailscale VPN client to blend into corporate environments.

The main module, compiled with Cython, relies on asyncio and Socket.IO to maintain an HTTPS channel to its C2, and establishes persistence via both registry Run keys and scheduled tasks that relaunch the backdoor every minute.

Unlike traditional RATs that expose a full interactive shell, ABCDoor emphasizes remote interaction through screen broadcasting and input emulation, including multi‑monitor streaming via ffmpeg and the Windows Desktop Duplication API.

It also ships with components for file operations, process management, clipboard exfiltration, rudimentary crypto operations, and self‑updating and self‑deletion logic that leave recognizable artifacts in the registry and file system.

For defenders, the campaign underscores several key points: tax‑themed lures remain highly effective, multi‑stage chains built on public loaders and custom plugins complicate detection, and geofencing reduces visibility into active operations.

Organizations in the targeted regions should tighten email controls around tax‑related content, monitor for unusual Python and ffmpeg usage, and hunt for ABCDoor’s persistence keys and directory structures to uncover latent infections.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.