216.73.217.22

Silver Fox

· Published 21/12/2025 00:22 · Modified 21/12/2025 00:22 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 00:22
Modified
21/12/2025 00:22
Updated at
21/12/2025 00:22
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
10 reports, 68 attack patterns (mitre), 9 malware, 7 sectors, 11 countries, 105 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (10)

Attack patterns (MITRE) (68)

  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1036.004 uses
    Masquerade Task or Service
  • T1003 uses
    OS Credential Dumping
  • T1574.002 uses
  • T1543 uses
    Create or Modify System Process
  • T1059.001 uses
    PowerShell
  • T1562 uses
    Impair Defenses
  • T1070.004 uses
    File Deletion
  • T1021 uses
    Remote Services
  • T1189 uses
    Drive-by Compromise
  • T1115 uses
    Clipboard Data
  • T1572 uses
    Protocol Tunneling
  • T1106 uses
    Native API
  • T1027.005 uses
    Indicator Removal from Tools
  • T1218 uses
    System Binary Proxy Execution
  • T1137 uses
    Office Application Startup
  • T1095 uses
    Non-Application Layer Protocol
  • T1036 uses
    Masquerading
  • T1059 uses
    Command and Scripting Interpreter
  • T1078.001 uses
    Default Accounts
  • T1219 uses
    Remote Access Tools
  • T1038 uses
  • T1105 uses
    Ingress Tool Transfer
  • T1566.002 uses
    Spearphishing Link
  • T1543.003 uses
    Windows Service
  • T1102 uses
    Web Service
  • T1071.001 uses
    Web Protocols
  • T1012 uses
    Query Registry
  • T1056.001 uses
    Keylogging
  • T1112 uses
    Modify Registry
  • T1107 uses
  • T1568 uses
    Dynamic Resolution
  • T1573 uses
    Encrypted Channel
  • T1588.001 uses
    Malware
  • T1129 uses
    Shared Modules
  • T1083 uses
    File and Directory Discovery
  • T1555 uses
    Credentials from Password Stores
  • T1132 uses
    Data Encoding
  • T1574.006 uses
    Dynamic Linker Hijacking
  • T1071 uses
    Application Layer Protocol
  • T1218.011 uses
    Rundll32
  • T1204 uses
    User Execution
  • T1057 uses
    Process Discovery
  • T1053.005 uses
    Scheduled Task
  • T1497 uses
    Virtualization/Sandbox Evasion
  • T1008 uses
    Fallback Channels
  • T1574.001 uses
    DLL
  • T1078 uses
    Valid Accounts
  • T1547.001 uses
    Registry Run Keys / Startup Folder
  • T1566 uses
    Phishing
  • T1553.006 uses
    Code Signing Policy Modification
  • T1566.001 uses
    Spearphishing Attachment
  • T1014 uses
    Rootkit
  • T1562.002 uses
    Disable Windows Event Logging
  • T1562.001 uses
    Disable or Modify Tools
  • T1574 uses
    Hijack Execution Flow
  • T1113 uses
    Screen Capture
  • T1027 uses
    Obfuscated Files or Information
  • T1033 uses
    System Owner/User Discovery
  • T1053 uses
    Scheduled Task/Job
  • T1036.005 uses
    Match Legitimate Resource Name or Location
  • T1068 uses
    Exploitation for Privilege Escalation
  • T1082 uses
    System Information Discovery
  • T1548 uses
    Abuse Elevation Control Mechanism
  • T1547 uses
    Boot or Logon Autostart Execution
  • T1204.002 uses
    Malicious File
  • T1055 uses
    Process Injection
  • T1064 uses
    Scripting

Malware (9)

  • ABCDoor uses
    Family
    Published 08/06/2026 10:30 · Modified 08/06/2026 10:30
  • Valley RAT uses
    Family
    Published 15/01/2026 12:03 · Modified 15/01/2026 12:03
  • UpdateDll uses
    Family
    Published 10/07/2024 10:19 · Modified 10/07/2024 10:19
  • gh0st RAT - S0032 uses
    Family
    Published 17/04/2026 23:18 · Modified 17/04/2026 23:18
  • Winos 4.0 uses
    Family
    Published 30/04/2026 09:42 · Modified 30/04/2026 09:42
  • RustSL uses
    Family
    Published 30/04/2026 09:42 · Modified 30/04/2026 09:42
  • PNGPlug uses
    Family
    Published 20/01/2025 11:09 · Modified 20/01/2025 11:09
  • Winos uses
    Family
    Published 10/07/2024 10:19 · Modified 10/07/2024 10:19
  • ValleyRAT uses
    Family
    Published 08/06/2026 10:30 · Modified 08/06/2026 10:30

Sectors (7)

  • Government targets
  • Retail targets
  • Transportation targets
  • Healthcare targets
  • Finance targets
  • Education targets
  • Manufacturing targets

Countries (11)

  • Canada targets
  • Taiwan targets
  • India targets
  • China targets
  • Japan targets
  • South Africa targets
  • Russian Federation targets
  • Indonesia targets
  • British Indian Ocean Territory targets
  • Hong Kong targets
  • United States of America targets

Indicators (105)