OIS Threat Research

Research

Campaign

Roiese: FortiBleed-Sourced Resale of Access to Taiwanese Enterprises

An initial access broker operating as Roiese is selling network access to 96 Taiwanese enterprises on the dark web and Telegram. Cross-referencing Hudson Rock's public dataset indicates the data most likely originates from the June 2026 FortiBleed credential leak. The list is the attacker's own claim, and the sample alone cannot prove that any organization was breached. Organizations whose supply chain touches the affected domains should immediately rotate the relevant credentials to cut off password-spray abuse.

Malware

Inside Silver Fox, Part 3: From DLL Sideloading to ValleyRAT

The final user-mode link of the Silver Fox chain: the legitimately signed NtHandleCallback.exe side-loads a malicious log.dll that spawns three parallel threads — RC4-decrypting and running ValleyRAT in memory, deploying two kernel drivers for anti-forensics, and maintaining the Defender exclusion. ValleyRAT hides its C2 config and plugins in the HKCU\Console registry, so deleting files or blocking the C2 alone does not clean the host.

Detection

Deep Dive into mshta.exe: Abuse of a Windows Native Tool in the Attack Chain

mshta.exe is a legitimate, built-in Windows tool for running HTA applications; its high system privileges make it a favorite LOLBin loader for attackers. Using a copy-paste phishing case impersonating NotebookLM, this report breaks down how attackers load a remote HTA and reshape the process chain via a scheduled task to evade mshta-to-powershell detection, and catalogs forensic artifacts — RunMRU, PowerShell history, and Prefetch — that can reconstruct the activity.

Campaign

Silver Fox APT Campaign Analysis: Fake LINE Delivery via SEO Poisoning and Impersonation Sites

Silver Fox drops malicious installers via SEO poisoning and a fake LINE download site: victims land on a phishing page ranked below the official download page, an external script and short link pull a malicious archive, and after extraction the payload escalates via UAC, injects Chrome's elevation_service.exe through direct Native API syscalls, installs a SYSTEM-level persistence service, and injects sihost.exe to beacon to C2 43.102.44[.]165.

Malware

Inside Silver Fox, Part 2: Failure Engineering and the EDR Vanishing Act

Silver Fox's second-stage loader men.exe is built to clear the ground while EDR is still online: it uses BYOVD to load a vulnerable signed driver and force-terminate protection in Ring 0, adds a malicious driver to blind and delete EDR, and uses staged drops, delayed decryption, and DACL anti-forensics to pave the way for the ValleyRAT core.

Report

A Practical Handbook for Security Incident Investigation and Malware Analysis

A systematic, hands-on guide to malware analysis: from building an isolated lab (FLARE VM / REMnux), through basic static and dynamic analysis, malicious-document (Office/PDF/RTF) dissection, and fileless attacks with PowerShell and WMI, to reverse engineering with Ghidra — helping you build a complete analysis capability from detection and response to forensics.

Campaign

Silver Fox APT: Centralization Features of the Delivery Chain

Silver Fox uses a front-end/back-end-split download-lure framework on some delivery sites: phishing landing pages SEO-squat on popular keywords, and once a download is clicked an external obfuscated script asks a short-link API for a dynamic link and drops the final payload. The key control surface has centralized from the phishing pages to the external script source and short-link API; blocking and monitoring these hub nodes cuts delivery more effectively than chasing the final payload.

Vulnerability

Analyzing CVE-2024-51324: From Vulnerability Principle to PoC

CVE-2024-51324 is an improper-privilege-management flaw (CWE-269) in Baidu Antivirus's BdApiUtil.sys (v5.2.3.116083): once loaded, any user can ask the kernel to terminate an arbitrary process (including EDR/AV) via IOCTL 0x800024B4. This report covers the principle through a working PoC, the stealth of its kernel-level termination, and detection via tracing driver loads with sc.exe.

Malware

Zarok Ransomware: A Chaos-Family Variant with Large-File Destruction

Zarok is a ransomware variant from the Chaos builder ecosystem: it AES-encrypts small and mid-size files, overwrites and deletes files over ~2.3 GB with 0x3F (unrecoverable even after paying), wipes restore points and backups to force operational downtime, and hijacks the clipboard to swap Bitcoin addresses for long-term theft — while its data-leak threat is pure bluff.