← threat actors
threat actor
Void Arachne
also tracked as silver fox 6, swimsnake 1
6 stories · 5 in the wild · July 5, 2026 – September 2, 2026
evidence: 5 observed
how they got in
- software update 1 · Sep 1
- seo poisoning 1 · Jul 11
- phishing email 1 · Jul 5
sectors
- consumers 1 · Sep 1
- critical infrastructure 1 · Jul 12
- defense 1 · Jul 12
- finance 1 · Jul 5
- government 1 · Jul 5
geography
- china 3 · Sep 1
- india 1 · Jul 5
malware and tools
- valleyrat 3 · Sep 2
- modbeacon 2 · Jul 12
- silver fox rootkit 1 · Sep 1
- winos 4.0 1 · Jul 5
techniques
- dll sideloading 2 · Sep 1
- dkom 1 · Aug 12
- kernel access 1 · Aug 12
- process memory access 1 · Aug 12
- traffic interception 1 · Aug 12
- remote access 1 · Jul 11
attack phases seen
- Initial access 3 · Sep 2
- Execution 2 · Sep 1
- Persistence 2 · Sep 1
- Command and control 2 · Jul 12
- Privilege escalation 1 · Aug 12
what we reported, newest first, grouped by story
Sep 1 – September 2, 2026 · 2 reports
- Silver Fox is shipping ValleyRAT inside signed Chinese adware built around the genuine QN Wallpaper tool — deliberately targeting the AV exclusions users add for nuisance software (The Hacker News).
· Sep 2 · observed · as silver fox · Threat Activity
- ValleyRAT (Silver Fox) is shipping as signed adware — a modified Chinese wallpaper tool, QN Wallpaper, that DLL-sideloads a malicious
libcef.dll from the install directory, with users often adding the whole folder to AV exclusions (Securelist). Separately, a full reverse-engineering write-up of the group's signed AV/EDR-killer kernel driver is now public (reverser.space).
· Sep 1 · observed · via software update · as silver fox · Threat Activity
August 12, 2026
- Nextron identified a cluster of WHQL-signed Windows kernel drivers sharing the same Autel Intelligent Technology Authenticode metadata — likely tied to the Silver Fox group. Together they deliver a near-complete set of ring0 primitives: arbitrary process/kernel memory access, manual kernel PE loading, DKOM hiding, input injection, WFP/NDIS traffic interception, and physical-memory access (Nextron IOCs).
· Aug 12 · observed · as silver fox · Threat Activity
Jul 11 – July 12, 2026 · 2 reports
- Silver Fox, a China-linked group, is deploying MODBEACON, a new Rust-based modular RAT, expanding its arsenal and infrastructure against key sectors. SC World
· Jul 12 · observed · as silver fox · Threat Activity
- MODBEACON, a new Rust-based RAT attributed by QiAnXin to China-linked Silver Fox, uses gRPC streaming for encrypted C2 and spreads via SEO-poisoned counterfeit installers. The Hacker News
· Jul 11 · none · via seo poisoning · as silver fox · Threat Activity & Malware
July 5, 2026
- Silver Fox (SwimSnake) runs an RBI-themed phishing lure to deliver ValleyRAT / Winos 4.0 via DLL sideloading to a live C2 — the first Reserve Bank of India-themed lure observed for this family (medium-high confidence). FalconFeeds
· Jul 5 · observed · via phishing email · as silver fox, swimsnake · Threat Activity