Gbhackers

Silver Fox APT Targets Taiwan with Winos 4.0 Malware Campaign

First seen 23 Feb 2026, 06:09 UTC • Fortinet

•45.2

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Silver Fox APT is conducting targeted attacks in Taiwan utilizing DLL sideloading and BYOVD techniques to deploy Winos 4.0 (ValleyRat). The campaigns leverage localized phishing lures related to tax and e-invoice processes, impacting Microsoft Windows users and leading to widespread file encryption and potential data theft.

How this analysis works

Timeline

2026-02-21

FortiGuard Labs reports on Silver Fox phishing campaigns in Taiwan

2026-02-23

Gbhackers details Silver Fox APT's use of DLL sideloading and BYOVD

Attack Flow

12 entities, 22 inferred relationships (STIX 2.1).

Threat Actor (2)

Silver Fox
Silver Fox APT

Technique (4)

Malware
Phishing
T1562.001 - Disable Or Modify Tools
T1574 - Hijack Execution Flow

Campaign (1)

Stealth Campaign

Indicator (3)

nat.gov
zbyq.cn
zju.edu

Malware (2)

ValleyRat
Winos 4.0

Relationships

Silver Fox uses ValleyRat
Silver Fox uses Winos 4.0
Silver Fox APT uses ValleyRat
Silver Fox APT uses Winos 4.0
Silver Fox uses Malware
Silver Fox uses Phishing
Silver Fox uses T1562.001 - Disable Or Modify Tools
Silver Fox uses T1574 - Hijack Execution Flow
Silver Fox APT uses Malware
Silver Fox APT uses Phishing
Silver Fox APT uses T1562.001 - Disable Or Modify Tools
Silver Fox APT uses T1574 - Hijack Execution Flow
ValleyRat communicates with nat.gov
ValleyRat communicates with zbyq.cn
ValleyRat communicates with zju.edu
Winos 4.0 communicates with nat.gov
Winos 4.0 communicates with zbyq.cn
Winos 4.0 communicates with zju.edu
Stealth Campaign attributed to Silver Fox
Stealth Campaign attributed to Silver Fox APT
Stealth Campaign uses ValleyRat
Stealth Campaign uses Winos 4.0

Continue Reading

Urgent CISA Directive: Patch Critical Ivanti EPMM Vulnerability CVE-2026-1340 by April 11 PATCHCORD Malware Targets Afghan Telecom and South Asian Infrastructure Silver Fox Cyber Campaign Exploits Fake Tax Alerts to Spread Malware Silver Fox Targets Japanese Firms with Spearphishing During Tax Season Cyber Campaign Targets Cambodia with Spark RAT via BYOVD Technique Silver Fox APT Campaign Distributes ValleyRAT via Fake Telegram Installer

Silver Fox APT Targets Taiwan with Winos 4.0 Malware Campaign

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading