Void ArachneThreat actor
- Silver Fox
Void Arachne is a threat actor group targeting Chinese-speaking users with malicious MSI files containing legitimate software installers for AI software. They exploit public interest in VPN technology and AI software to distribute malware through SEO poisoning and Chinese-language-themed Telegram channels.From MISP Galaxy
Last reported 4 days ago, by The Hacker News5 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1014Rootkit
“…e the leak of ValleyRAT builder in 2023, the intrusion set continued to use it, exploiting zero-day driver plugin and using kernel-mode rootkit likely for intelligence collection.”
- T1036Masquerading
“ValleyRAT masquerading as adware”
- T1055.012Process Hollowing
“If the payload is shellcode, the backdoor uses process hollowing with svchost to launch the module.”
- T1199Trusted Relationship
“These campaigns notably rely on trusted relationships with partners or the administration to entice the targeted entity to download or click on a link in order to deploy the malicious payload.”
- T1204.005Malicious Library
“Malicious library”
- T1213.005Messaging Applications
“Primary intrusion vectors included the abuse of leaked credentials obtained through encrypted messaging applications such as Telegram and Signal, marketplace forums, and initial access brokers.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware“However, it shares no overlaps with RomulusLoader, a malware family associated with Silver Fox (aka TA4922), a China-aligned threat actor known for repeatedly using tax-related pretexts to distribute remote access trojans like ValleyRAT (aka Winos 4.0), DcRAT, and potentially Ven…”
-
ValleyRAT masquerading as adware“This attack geography, combined with the use of the ValleyRAT backdoor, points to Silver Fox, a known operator of this malware family, as the likely group behind the campaign.”
-
Silver Fox: The only Tax Audit Where Fine Print Installs Malware“Silver Fox: The only Tax Audit Where Fine Print Installs Malware”
-
A cunning predator: How Silver Fox preys on Japanese firms this tax season“A cunning predator: How Silver Fox preys on Japanese firms this tax season”
-
JSAC2026 -Day 2-“Satoshi Kamekawa presented an analysis of a phishing campaign targeting Japanese organizations that was attributed to “Silver Fox” and observed between September and October 2025.”
Indicators in its reports
named in the reports above- c24e99f9437feacaa63766a3cde3fe3din 1 report
- hxxps://meeting.tencent[.]com/download/in 1 report
- hxxps://qnwallpaper.keansoft[.]cn/in 1 report
- qnwallpaper.keansoft[.]cnin 1 report
- 7ad1e3ef4e6d9d636c9e7e967733850ein 1 report
- 96b4c1d0683dce22bd3223e1e40689c1in 1 report
- 9b86d3ab6cef15c633933fbbeab39c0ain 1 report
- edfdc30cbd85879776b8f735ea7de1f1in 1 report
- 07ddbbe2c71c45577a7a4fbcdba0df91in 1 report
- 48826d5ca845979d2e6ebd66dc1aae90in 1 report
- 6c158c0f8e029342192d4f0d72e102b7in 1 report
- 9a71d6a41cd258b9e89cdc5fc224de73in 1 report
- 8a626d844943da3456b044f38deae3a2in 1 report
- 103.45.66[.]18in 1 report
- 192.253.225[.]173in 1 report
- e2b75baeb7ed21fb…167bd24ba6dcin 1 report
- hxxps://6-1321729461.cos.ap-guangzhou.myqcloud[.]com/lnstaller.msiin 1 report
- hxxps://00-1321729461.cos.ap-guangzhou.myqcloud[.]com/2024.7zin 1 report
- 9010.360sdgg[.]comin 1 report
- googlevip[.]icuin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.