An initial access broker operating as Roiese is selling network access to 96 Taiwanese enterprises on the dark web and Telegram. Cross-referencing Hudson Rock's public dataset indicates the data most likely originates from the June 2026 FortiBleed credential leak. The list is the attacker's own claim, and the sample alone cannot prove that any organization was breached. Organizations whose supply chain touches the affected domains should immediately rotate the relevant credentials to cut off password-spray abuse.
The final user-mode link of the Silver Fox chain: the legitimately signed NtHandleCallback.exe side-loads a malicious log.dll that spawns three parallel threads — RC4-decrypting and running ValleyRAT in memory, deploying two kernel drivers for anti-forensics, and maintaining the Defender exclusion. ValleyRAT hides its C2 config and plugins in the HKCU\Console registry, so deleting files or blocking the C2 alone does not clean the host.
Silver Fox drops malicious installers via SEO poisoning and a fake LINE download site: victims land on a phishing page ranked below the official download page, an external script and short link pull a malicious archive, and after extraction the payload escalates via UAC, injects Chrome's elevation_service.exe through direct Native API syscalls, installs a SYSTEM-level persistence service, and injects sihost.exe to beacon to C2 43.102.44[.]165.
Silver Fox's second-stage loader men.exe is built to clear the ground while EDR is still online: it uses BYOVD to load a vulnerable signed driver and force-terminate protection in Ring 0, adds a malicious driver to blind and delete EDR, and uses staged drops, delayed decryption, and DACL anti-forensics to pave the way for the ValleyRAT core.
Silver Fox APT wraps a malicious Pascal script inside an Inno Setup installer that performs environment reconnaissance, adds the entire C: drive to the Defender exclusion list, disables network adapters to block reporting, and then decrypts and drops the next-stage loader men.exe. This report reconstructs the landing stage of that seemingly normal installer.
Silver Fox uses a front-end/back-end-split download-lure framework on some delivery sites: phishing landing pages SEO-squat on popular keywords, and once a download is clicked an external obfuscated script asks a short-link API for a dynamic link and drops the final payload. The key control surface has centralized from the phishing pages to the external script source and short-link API; blocking and monitoring these hub nodes cuts delivery more effectively than chasing the final payload.
Zarok is a ransomware variant from the Chaos builder ecosystem: it AES-encrypts small and mid-size files, overwrites and deletes files over ~2.3 GB with 0x3F (unrecoverable even after paying), wipes restore points and backups to force operational downtime, and hijacks the clipboard to swap Bitcoin addresses for long-term theft — while its data-leak threat is pure bluff.