Silver Fox Group Targets Companies in Taiwan

Fortinet FortiGuard Labs researchers are sounding the alarm about a new and sophisticated phishing campaign targeting companies in Taiwan and infecting them with malware such as the HoldingHands RAT and Gh0stCringe . Both malware belong to the broader Gh0st RAT family , a tool often associated with Chinese cyberespionage groups. According to Fortinet’s analysis , the campaign is attributed to a threat actor tracked as the “ Silver Fox APT .”

The new attacks are part of a broader campaign distributed by the Winos 4.0 malware framework in early January, sending phishing emails impersonating Taiwan's National Taxation Bureau.

The cybersecurity company said it had identified additional malware samples through ongoing monitoring.

See also: The most common phishing scams for crypto users – How to recognize them

The Silver Fox APT group's tactics include sending malicious emails that appear to be from government agencies or business partners, using topics related to taxes, pensions, or invoices as bait. Recipients are invited to open attached PDFs or ZIP files, which contain embedded malicious content, such as shellcode loaders and encrypted payloads.

The infection chain is complex and multi-layered. It involves the use of a shellcode loader to decrypt and execute the shellcode, which is nothing more than DLL files that are sideloaded from legitimate binaries using DLL side-loading. The intermediate payloads incorporate anti-VM and privilege escalationto ensure that the malware runs unhindered on the compromised host.

The final phase of the attack involves the execution of “msgDb.dat”, which allows remote control of the infected computer. Through this, cybercriminals can collect data, manage files, and gain full access to the victim’s desktop.

See also: Black Basta: Former members return with Microsoft Teams phishing & Python Scripts

Fortinet reports that the Silver Fox APT group continues to adapt its methods, constantly evolving the tools and techniques for distributing the Gh0stCringe malware, making detection and countermeasures particularly difficult.

In this context, experts warn of increased vigilance, emphasizing the need to strengthen cybersecurity measures in government agencies and businesses operating in the region.

The fact that users in Taiwan are mainly affected, combined with the use of malicious tools that have a history of association with Chinese groups, suggests geopolitical motivations. The exploitation of state institutions (such as the tax authority) as bait reinforces the image of a campaign aimed at espionage, data collection, or even infrastructure sabotage.

See also: New phishing campaign abuses legitimate tool NetBird

Defending against such threats requires user education, isolation strategies , and real investment in threat monitoring and incident management. Governments, especially in areas of geopolitical tension, should approach cybersecurity not as an option but as a fundamental aspect of national defense.

Source: thehackernews.com