Executive Summary
In early 2026, the Silver Fox threat group launched a sophisticated phishing campaign targeting industrial, consulting, and retail sectors in Russia and India. Disguised as tax audit notices, the attacks utilize a multi-stage infection chain starting with a customized Rust-based loader called RustSL. This loader is engineered with geofencing and anti-analysis capabilities to deliver the ValleyRAT backdoor and a newly discovered Python backdoor dubbed ABCDoor.
ABCDoor represents a significant evolution in the group's arsenal, utilizing Cython-compiled modules, Socket.IO for asynchronous C2 communication, and the 'Phantom Persistence' technique to ensure long-term access. The malware mimics legitimate services like Tailscale and uses legitimate Python environments to evade standard endpoint detection. Its primary functions include screen broadcasting via ffmpeg and remote manipulation of the file system and user inputs.
This campaign highlights the group's expanding geographic reach and their ability to integrate public red-team frameworks with proprietary backdoors. Organizations in the targeted regions should prioritize monitoring for anomalous registry modifications and unauthorized scheduled tasks named 'AppClient', as well as unexpected network activity to identified C2 infrastructure.