Silver Fox APT Targets Taiwan with Winos 4.0 Malware Campaign

Gbhackers

Silver Fox APT Targets Taiwan with Winos 4.0 Malware Campaign

First seen 23 Feb 2026, 06:09 UTC • •45.2

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

Silver Fox APT is conducting targeted attacks in Taiwan utilizing DLL sideloading and BYOVD techniques to deploy Winos 4.0 (ValleyRat). The campaigns leverage localized phishing lures related to tax and e-invoice processes, impacting Microsoft Windows users and leading to widespread file encryption and potential data theft.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 217d ago How this analysis works

Timeline

2026-02-21

FortiGuard Labs reports on Silver Fox phishing campaigns in Taiwan

2026-02-23

Gbhackers details Silver Fox APT's use of DLL sideloading and BYOVD

More articles in this cluster (4)

Threat Graph

9 entities, 16 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

Silver Fox
Silver Fox APT

Technique (4)

Malware
Phishing
T1562.001 - Disable Or Modify Tools
T1574 - Hijack Execution Flow

Campaign (1)

Stealth Campaign

Malware (2)

ValleyRat
Winos 4.0

Relationships

Silver Fox uses ValleyRat
Silver Fox uses Winos 4.0
Silver Fox APT uses ValleyRat
Silver Fox APT uses Winos 4.0
Silver Fox uses Malware
Silver Fox uses Phishing
Silver Fox uses T1562.001 - Disable Or Modify Tools
Silver Fox uses T1574 - Hijack Execution Flow
Silver Fox APT uses Malware
Silver Fox APT uses Phishing
Silver Fox APT uses T1562.001 - Disable Or Modify Tools
Silver Fox APT uses T1574 - Hijack Execution Flow
Stealth Campaign attributed to Silver Fox
Stealth Campaign attributed to Silver Fox APT
Stealth Campaign uses ValleyRat
Stealth Campaign uses Winos 4.0

Following this threat?

Track Silver Fox and ValleyRat in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…

Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring…