Silver Fox APT Campaign Analysis: Fake LINE Delivery via SEO Poisoning and Impersonation Sites

Introduction

Over the past two years, SEO poisoning has risen to become a mainstream initial-access technique, with attackers substituting legitimate third-party software resources to gain a foothold. Readers on the front lines of security monitoring are likely no strangers to lineoe and its many domain variants. This report is the product of the author’s team tracking Silver Fox impersonation-site campaigns in depth over the past year, covering more than 50 malicious samples and over 70 fake download pages, with a detailed analysis of a representative sample from December 2025.

Silver Fox is an advanced, long-running threat cluster operating out of China and Southeast Asia, believed to be made up of multiple loosely affiliated sub-groups that also sell tooling and infrastructure to other cybercrime groups for profit; its targets span East and Southeast Asia, including China, Taiwan, Korea, Japan, and India. Its signature tool, the Winos 4.0 trojan, is commonly paired with the privilege-escalation utility NVIDIA.exe. In this tracking effort, we found Silver Fox’s dedicated modules NVIDIA.exe, LetsPro.exe, and the Winos core all bundled inside the impersonation site’s installer, which lets us attribute this activity to Silver Fox.

This report is intended only for defensive research, incident response, threat hunting, and educational purposes. The samples and tools referenced may be dangerous; test them only in isolated, restorable environments not connected to a production network. Third-party platform and product names are used only for technical description.

Investigation and analysis (using linebcn[.]com)

The root cause behind this attack succeeding is that the official LINE download page, https://www.line.me, does not rank for a “download” keyword in search results, so many users searching for it land instead on a phishing site ranked below the official page with a download-focused title.

Phishing site analysis: the phishing site’s front-end source shows clear WordPress Yoast SEO fingerprints (Yoast SEO is a key tool Silver Fox uses to maintain search ranking on its phishing sites; most phishing sites we currently track use this framework for optimization).

Domain tracking shows the attacker’s phishing site sits behind Cloudflare.

Clicking the download button actually triggers nice.js, which listens for the pcgetDown class on the download button:

<script src="hxxps://js.telegram[.]organic/site/nice.js"></script>

Function _0x516082 uses document.addEventListener('click', …, true)
to listen for clicks matching these CSS classes:
  pcgetDown      → marks the device as PC
  androidgetDown → marks the device as mobile
  getDown        → auto-detects based on User-Agent
On this site, only the PC download has a pcgetDown button; other paths redirect directly.

Once triggered, pcgetDown redirects to hxxps://6x[.]org/sgObMA to pull the malicious file. For a detailed breakdown of nice.js, see the team’s other report, Silver Fox APT: Centralization Features of the Delivery Chain.

Sample landing analysis

The malicious file is distributed as an archive. After the user extracts and runs it, the program requests elevated privileges via UAC; once the user allows it, the malware gains higher privileges and continues its subsequent behavior.

The execution chain after gaining privileges is as follows:

The main behaviors break down into: ① running LinasInste-x64.6.4.4.exe, which creates and launches the core process G6AxaXgq.exe; ② G6AxaXgq.exe launches Google Chrome’s elevation_service.exe and injects it via Native API; ③ elevation_service.exe establishes persistence via a service; ④ the attacker uses sihost.exe to establish a connection to the remote C2.

G6AxaXgq.exe launch

After running LinasInste-x64.6.4.4.exe, the program first creates a temp file, LinasInste-x64.6.4.4.tmp, then renames it to G6AxaXgq.exe and launches it, lowering the odds of detection.

Launching and injecting elevation_service.exe

G6AxaXgq.exe performs memory operations via Windows Native API (syscalls) to load shellcode into memory and inject it into elevation_service.exe: it first calls NtProtectVirtualMemoryRemote to modify the target memory’s protection attributes, then writes the shellcode — a fileless approach that lowers the chance of AV detection. The mutex 1kSglj33TDTREZ3cvNwYF8O8 prevents duplicate execution.

G6AxaXgq.exe then calls SCM via RPC to attempt to acquire query/start/stop rights on specific services. The logs show most services returning retval = 1060 (ERROR_SERVICE_DOES_NOT_EXIST, the service does not exist), while WinDefend returns retval = 0 (success).

Finally, G6AxaXgq.exe launches elevation_service.exe and completes the injection using NtMapViewOfSectionRemote (mapping a malicious memory section into the target process) and NtDuplicateObject (duplicating the process handle of elevation_service.exe PID 9908 into G6AxaXgq.exe PID 10744), letting it perform memory operations on and execute malicious code inside that process.

elevation_service.exe establishes persistence via a service

The logs show elevation_service.exe creating a suspicious service named az9PlH, with these registry characteristics: ObjectName = LocalSystem (running with SYSTEM privileges), Start = 2 (auto-start at boot), Type = 16 (SERVICE_WIN32_OWN_PROCESS), a random DisplayName (obfuscation), an ImagePath pointing to cmd /c running a suspicious executable in an IIS directory, and ErrorControl = 0. This confirms the service’s real purpose is to launch the malware.

HKLM\System\CurrentControlSet\Services is the registry key Windows uses to store system service and driver configuration. The attacker uses the Windows Service API (which communicates with SCM over RPC under the hood) to create a malicious service, gaining SYSTEM privileges and maintaining long-term access.

C2 connection via sihost.exe

elevation_service.exe (PID 9908) uses NtDuplicateObject to obtain a process handle with PROCESS_ALL_ACCESS rights to sihost.exe (PID 4700), then allocates and writes malicious code into sihost.exe’s memory using NtAllocateVirtualMemoryRemote, NtWriteVirtualMemoryRemote, and NtProtectVirtualMemoryRemote, modifying the permissions to make it executable. This lets the attacker take control of sihost.exe and use this legitimate system process to beacon out to C2 43.102.44[.]165, blending malicious traffic into normal system activity.

Conclusion

This sample demonstrates a complete capability set for intrusion, privilege escalation, persistence, and remote control: after the user runs LinasInste-x64.6.4.4.exe from the archive, the malware creates a temp file and renames it to G6AxaXgq.exe as the primary process; after UAC elevation, it injects shellcode into elevation_service.exe via Windows Native API; it then abuses SCM to create the SYSTEM-privileged service az9PlH for persistence; and finally injects the system process sihost.exe, using it to communicate with C2 43.102.44[.]165. The overall toolchain (NVIDIA.exe, LetsPro.exe, the Winos core) allows this activity to be attributed to Silver Fox.

Sample and references

• Original article (Medium, OIS, Traditional Chinese): 《Silver Fox APT 攻擊活動分析：結合 SEO 與偽冒網站的 Fake Line 推送手法》
• Related research: Silver Fox APT: Centralization Features of the Delivery Chain
• MITRE ATT&CK — basis for the technique mapping