Breaches and incidents
Silver Fox (India): Income Tax Department-themed phishing delivers ValleyRAT
CloudSEK (reported by The Hacker News) documented emails with decoy PDFs posing as Income Tax Department correspondence.
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- CloudSEK (reported by The Hacker News) documented emails with decoy PDFs posing as Income Tax Department correspondence; Kaspersky later tracked the same wave beginning in India in December 2025.
- Technique: PDF link to ggwk[.]cc serving “tax affairs.zip” with an NSIS installer that runs a legitimate Xunlei Thunder binary sideloading a malicious libexpat.dll, which disables Windows Update, runs anti-sandbox checks and uses a Donut loader to inject ValleyRAT (Winos 4.0) into a hollowed explorer.exe.
- Attacker: Silver Fox, a China-linked cybercrime group (also SwimSnake, Void Arachne), per CloudSEK.
- Response: IOCs published; no Indian victim count disclosed.