SilverFox cyber-espionage group activity

The SilverFox cyber-espionage group has expanded its operational capabilities and geographic reach across the Asia-Pacific region. Initially, the group targeted Japanese industrial manufacturers using the ValleyRAT remote-access trojan. This campaign utilized phishing emails and a sophisticated “bring-your-own-vulnerable-driver” (BYOVD) chain to achieve kernel-level execution and maintain persistence by bypassing security tools.

More recent activity indicates a shift toward integrating artificial intelligence to accelerate attacks. The group has been observed distributing fraudulent AI applications, such as fake versions of the Claude assistant, to infiltrate corporate networks. New AI-powered tools have been identified, including the JADEPUFFER ransomware agent, the prompt-injection tool ChatGPhish, and the cloud-based malware framework VoidLink.

While the group previously targeted Japanese industry, recent data shows China as the primary target, accounting for 90% of attacks, alongside significant activity in Myanmar, Cambodia, and Singapore. The manufacturing sector remains a frequent target, alongside IT, healthcare, and finance.