What is Silver Fox? The latest cyber attacks targeting Japanese companies in Winos 4.0

**What is Silver Fox and Winos 4.0, HoldingHands RAT? **

Silver Fox is a Chinese cybercrime organization known by names such as "SwimSnake", "Valley Thief", and "Void Arachne".
The most common malware they use is Winos 4.0 (aka ValleyRAT), and more recently they are used in conjunction with malware such as the HoldingHands RAT.

The attack method is a phishing email with a PDF attached under the guise of an official document of the Ministry of Finance.
This PDF contains several hidden links that will lead you to download a ZIP file with Winos 4.0 or the HoldingHands RAT when you click on it.
It is true that the documents you usually see are just a trap.

---

Attack Flow: DLL Sideloading and Privilege Escalation

The executable file opened by the user as a "tax audit document" is actually designed to load a malicious DLL.
This DLL further launches the following payload, 'sw.dat', which does the following:

• Check the virtual environment (avoid analysis)
• Close antivirus software such as Avast, Norton, Kaspersky, etc.
• Disable Windows Task Scheduler
• Disguise TrustedInstaller privileges to elevate privileges

What's particularly annoying is replacing and persisting legitimate Windows files (TimeBrokerClient.dll).
When the task scheduler is restarted, it automatically activates malicious DLLs, making it very difficult for antivirus software to find.

---

Features of the HoldingHands RAT

The HoldingHands RAT is a derivative of the Gh0st RAT that was leaked in 2008.
Key features include:

• Collect information about infected PCs and send them to attackers
• Stay connected with a heartbeat signal every 60 seconds
• Run remote commands and download additional payloads
• Dynamically change the address of the C2 server from the Windows registry

This allows attackers to hide in systems for extended periods of time, which Fortinet evaluates as region-based espionage.

---

Threat Points

There are four things to note about Silver Fox's move:

1. Geographic Expansion – From China and Taiwan to Japan and Malaysia
2. Clever social engineering – phishing under the guise of official documents or recruitment documents
3. BYOVD Attacks – Exploiting Vulnerable Drivers to Neutralize Security
4. Latent – Persistence with TrustedInstaller impersonation and task scheduler

It is an attack that goes beyond a simple malware infection and has a strong color of long-term information gathering and espionage activities.
Businesses and public institutions in the country also need to prepare for future spread risks.

---

Countermeasures: Prevention is the Greatest Defense

For advanced phishing and RAT attacks, it is important to have both technical and operational defenses.

1. Enhanced Email Security
   • Filtering PDF and ZIP attachments
   • Outbound domain verification, DMARC/SPF implementation
2. Endpoint Monitoring (EDR)
   • DLL sideloading check
   • Process tree anomaly monitoring
3. Authority Management
   • Monitor changes in Trusted Installer permissions
   • Regularly check unnecessary admin privileges accounts
4. Security Education
   • Sharing examples of attacks disguised as tax documents and recruitment documents
   • Make it a habit to check email links and attachments

---

Conclusion: Back to the Basics

Silver Fox's attack once again shows that social engineering sophistication is more dangerous than malware sophistication.
The origin of all security threats is ultimately a "user click".

Adhering to the basic principles is the strongest defense:

• Do not open files of unknown origin
• Account operates with least privileges
• Keep your security software up to date

Additional monitoring and regular audits can help you build a robust defense posture that is flexible and resilient to changing threats.

---

That's it for Yoon Jae-ho of Colorkrew Security.
Thank you for reading to the end. Stay tuned for our next post.