CloudSEK’s Threat Research and Information Analytics Division (TRIAD) has uncovered an ongoing cyber espionage campaign targeting Indian organizations using income tax–themed phishing lures.
The operation has been attributed to the Chinese state-sponsored Silver Fox APT, marking the first confirmed connection between this lure type and the group’s infrastructure.
The phishing emails appear to mimic legitimate notifications from the Indian Income Tax Department and include attachments labeled “TOPSOE India Private Limited.”
Once opened, the PDF leads to the domain ggwk[.]cc, triggering the download of a malicious ZIP file containing an executable named “tax affairs.exe.”
Technical analysis revealed the executable as a Nullsoft Scriptable Install System (NSIS) installer, commonly used to embed compressed payloads within legitimate-looking binaries.
Multi-Stage Attack Chain
The installer begins execution by creating a temporary working directory and dropping two files: Thunder.exe and libexpat.dll. While Thunder.exe is a genuine, digitally signed application from the Chinese company Xunlei, it is abused here to hijack the DLL search order.
When executed, the binary loads the malicious libexpat.dll instead of the legitimate version, allowing the attacker’s code to run under a trusted process.
The DLL performs several anti-debugging and sandbox-evasion checks, disables the Windows Update service, and loads an encrypted payload from box.ini.
After decrypting and executing it as shellcode, the malware injects itself into explorer.exe. This payload acts as a DonutLoader, decrypting and running the final malicious module entirely in memory to avoid disk detection.
The ultimate payload is identified as Valley RAT, a remote access Trojan capable of keylogging, remote shell access, file transfer, and registry-based persistence.
The RAT communicates with its command-and-control (C2) servers via a three-tier failover system involving domains such as b[.]yuxuanow[.]top, itdd[.]club, and gov-a[.]work, ensuring continuous connectivity even if primary servers are blocked. It also supports both HTTP/HTTPS and raw TCP protocols for flexible communication.
Advanced Persistence and Attribution
Valley RAT maintains persistence by storing encrypted plugins in the Windows Registry, enabling attackers to update capabilities or deploy new modules without re-infecting the system.
These plugins, injected into tracerpt.exe (a signed Microsoft binary), extend the malware’s features for credential theft and surveillance.
After pivoting from shared infrastructure elements such as a standard favicon and domain registration patterns, CloudSEK attributed the campaign to Silver Fox APT, a Chinese group known for regional espionage operations.
The report emphasizes that correct attribution is key to understanding adversary behavior, warning that misclassification could mislead defense strategies.
CloudSEK recommends that organizations monitor suspicious registry changes, detect process injection behaviors, and track multi-tier C2 activity to detect similar threats early.
Follow us on Google News , LinkedIn and X to Get More Instant Updates, Set Cyberpress as a Preferred Source in Google.
 has uncovered an ongoing cyber.){kind=link}