Back Gbhackers

Silver Fox Tax Audit Phishing Campaign Shifts from RATs to Python Stealers

Gbhackers •Mayura Kathir • March 26, 2026

Threat intelligence teams have tracked Silver Fox (also known as Void Arachne), a China-based intrusion set that sits at the intersection of financially motivated cybercrime and APT-style espionage. Originally associated with large-scale, profit-driven campaigns, the group has steadily adopted more advanced tradecraft, including modular backdoors, rootkits, and the exploitation of vulnerable drivers. TDR’s monitoring between […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Silver Fox Targets Japanese Firms with Spearphishing During Tax Season The Silver Fox cyber threat group is conducting a targeted spearphishing campaign against Japanese businesses, particularly manufacturers, during the annual tax filing and corporate restructuring season. The attackers exploit the high volume of legitimate financial and HR communications, using emails that impersonate internal departments and executives. Common phishing lures include tax compliance violations and salary adjustments, which make employees more likely to trust and act on these messages. The campaign has been active since at least 2023 and has expanded from Chinese-speaking targets to include Japan and Southeast Asia. The malicious emails typically contain links or attachments that deploy ValleyRAT, a remote access trojan, allowing attackers to gain unauthorized access to systems. Silver Fox has a history of aligning its operations with regional business cycles, as similar phishing activity was observed in Japan last year. Organizations are advised to enhance employee awareness and verify all financial requests through separate communication channels. 8 sources 70

Extracted Entities

Silver Fox Tax Audit Phishing Campaign Shifts from RATs to Python Stealers

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)