OIS Threat Research

Open InfoSec · OIS Threat Research

Seeing farther.
Looking deeper.

OIS Threat Research starts at the frontline incident scene, reverse-engineering malware, tracking adversaries, and exposing the tools, techniques, and intent behind attacks.

Latest research About
Campaign

Roiese: FortiBleed-Sourced Resale of Access to Taiwanese Enterprises

An initial access broker operating as Roiese is selling network access to 96 Taiwanese enterprises on the dark web and Telegram. Cross-referencing Hudson Rock's public dataset indicates the data most likely originates from the June 2026 FortiBleed credential leak. The list is the attacker's own claim, and the sample alone cannot prove that any organization was breached. Organizations whose supply chain touches the affected domains should immediately rotate the relevant credentials to cut off password-spray abuse.

2026-07-24 · Dinlon · OIS-2026-008

Read research →

Latest research

All research →
Malware

Inside Silver Fox, Part 3: From DLL Sideloading to ValleyRAT

The final user-mode link of the Silver Fox chain: the legitimately signed NtHandleCallback.exe side-loads a malicious log.dll that spawns three parallel threads — RC4-decrypting and running ValleyRAT in memory, deploying two kernel drivers for anti-forensics, and maintaining the Defender exclusion. ValleyRAT hides its C2 config and plugins in the HKCU\Console registry, so deleting files or blocking the C2 alone does not clean the host.

Detection

Deep Dive into mshta.exe: Abuse of a Windows Native Tool in the Attack Chain

mshta.exe is a legitimate, built-in Windows tool for running HTA applications; its high system privileges make it a favorite LOLBin loader for attackers. Using a copy-paste phishing case impersonating NotebookLM, this report breaks down how attackers load a remote HTA and reshape the process chain via a scheduled task to evade mshta-to-powershell detection, and catalogs forensic artifacts — RunMRU, PowerShell history, and Prefetch — that can reconstruct the activity.

Campaign

Silver Fox APT Campaign Analysis: Fake LINE Delivery via SEO Poisoning and Impersonation Sites

Silver Fox drops malicious installers via SEO poisoning and a fake LINE download site: victims land on a phishing page ranked below the official download page, an external script and short link pull a malicious archive, and after extraction the payload escalates via UAC, injects Chrome's elevation_service.exe through direct Native API syscalls, installs a SYSTEM-level persistence service, and injects sihost.exe to beacon to C2 43.102.44[.]165.

Malware

Inside Silver Fox, Part 2: Failure Engineering and the EDR Vanishing Act

Silver Fox's second-stage loader men.exe is built to clear the ground while EDR is still online: it uses BYOVD to load a vulnerable signed driver and force-terminate protection in Ring 0, adds a malicious driver to blind and delete EDR, and uses staged drops, delayed decryption, and DACL anti-forensics to pave the way for the ValleyRAT core.