Silver Fox APT: Centralization Features of the Delivery Chain

Background

While collecting intelligence on Silver Fox APT assets, we observed a series of front-end download-lure frameworks with a consistent behavioral pattern. These sites SEO-squat popular keywords to lure users via search engines into fake download pages; when the user clicks download, the site loads an external JavaScript resource and triggers redirection, requesting a dynamic short link from a specified API and dropping the final payload. The framework has these designs:

1. Filters on HTTP header fields to evade direct scanning.
2. Aggregates the download redirection of multiple phishing sites onto a single external site for centralized control, distribution, drop-point switching, and click statistics.
3. Separates the front-end landing page from the delivery-side API to reduce the damage of a phishing site being blocked.
4. Uses an interaction event as a threshold so automated analysis that never triggers a click cannot obtain the delivery link.

Although the attacker makes the final drop point more replaceable and lowers passive-observation visibility via front/back separation and dynamic short links, this analysis shows the convergence shifts the key control surface from the old phishing landing pages to the external script source and short-link API. Rather than chasing the final drop point, blocking and monitoring the hub nodes more effectively cuts the delivery flow and reduces the victim surface.

This report is intended only for defensive research, incident response, threat hunting, and educational purposes. The samples and tools referenced may be dangerous; test them only in isolated, restorable environments not connected to a production network. Third-party platform and product names are used only for technical description.

Behavioral investigation (using linebbn[.]com)

Using the recently common linebbn[.]com as a demo. Searching Google for “line 電腦版下載” (LINE PC download), the target site usually appears in the top few results.

The site has been on our watchlist for a while, but recent automated scans keep failing. Direct access by URL returns a 500 Error, while adding Referer: google.com yields normal page content — confirming the site conditionally releases by source:

curl www.linebbn[.]com -v -H "referer: google.com"

These sites use WordPress with the Yoast SEO Premium plugin v20.4. When the user clicks a download button, it triggers hxxps://js.telegram[.]organic/site/nice.js, a heavily obfuscated JavaScript resource.

The script hijacks download-button clicks: when the user clicks an element with a specific class (e.g. pcgetDown, androidgetDown), it collects page info and device type, POSTs to a third-party API for a short link, then opens it through multiple steps with evasion and anti-analysis measures. Source-code analysis with the API domain removed is in VirusStrategy / WinosDrop-nice.js.

Obfuscation techniques

Static-string-index breaking — the script defines a string-index function _0x3aa7 and a plaintext string array _0x41fe() at the top; other functions call via an index map with an index value, which must have 0x198 subtracted to get the real string.

Immediately-invoked function expression (IIFE) — an IIFE acts as the launcher, re-running the string-table index on load so indices only resolve when the arithmetic matches, and wraps the main logic in a private scope that runs immediately on load.

Initialization

On load the script defines: User-Agent detection (_0x259491 checks navigator.userAgent, classing Android/iPhone/iPad as mobile and the rest as pc); and an MD5 function (identified as standard MD5 by the hardcoded 0x67452301, 0xefcdab89 constants, used for API signing).

Event listening and API request

_0x516082 uses document.addEventListener('click', ..., true) to listen for clicks matching these CSS classes: pcgetDown (PC), androidgetDown (Mobile), getDown (auto by UA). On this site only the PC download has a pcgetDown button; other options link directly.

On a detected click, the script: prevents the default (preventDefault(), stopPropagation()); generates a signature (hardcoded key 14729935cmDLpt, final signature MD5(key + timestamp + current domain)); and sends a request (POST to hxxps://api.6x[.]org/v1 with timestamp, source domain ref (www. stripped), device type, and signature).

Malicious payload delivery

When the API returns HTTP 200 with a short_url, the script dynamically creates an <a> tag, sets href to the returned malicious short URL, sets rel="noreferrer noopener" and target="_blank", inserts it into the DOM, programmatically triggers .click(), then removes it. The user is silently redirected to the drop point, while automated scanners cannot directly obtain the final drop point. In testing, the target decides whether to return a short link with a malicious sample based on the sender’s IP and past connection history.

Analysis shows the final dropped sample matches the family report Antiy analyzed in December 2025, a multi-stage loader that ultimately loads Winos RAT (see Antiy: SwimSnake (Silver Fox) TTP tracking).

Intelligence investigation

Querying domains in the attacker’s assets revealed interesting subdomains and history. A Google search found a now-inaccessible record; subdomain enumeration found a login interface.

Intelligence-tool queries show the domain was used in phishing pages before August 2025; DNS records show it was registered at GKG.NET in 2022, moved its CDN to Cloudflare in February 2025, and then began registering many subdomains to prepare the campaign.

Conclusion

This investigation mainly confirms that Silver Fox, on some of its delivery sites, uses a front/back-separated download-lure framework, completing dynamic distribution of download links via an external script and a short-link API, separating the final payload’s drop point from the phishing landing page.

For defenders, this framework shifts the detection and tracking features from the old phishing landing pages to the external script source and short-link API. We recommend extending defenses to blocking and monitoring the hub nodes, including detecting outbound traffic to the external-script domains and API sites, and adding the source redirection sites to monitoring when the above intelligence is observed — which more effectively cuts the delivery flow and reduces risk.

Sample and references

• Original article (Medium, OIS, Traditional Chinese): 《Silver Fox APT：遞送鏈的中樞化特徵研究》
• VirusStrategy — WinosDrop-nice.js (analysis with API domain removed)
• Antiy: SwimSnake (Silver Fox) TTP tracking
• MITRE ATT&CK — basis for the technique mapping