A cunning predator: How Silver Fox preys on Japanese firms this tax season
Essential information
- Published
- 28/03/2026 16:12
- Modified
- 30/03/2026 10:12
- Tags
- 2026-03-28 financial lures hr lures japan remote access trojan spearphishing targeted attacks tax season valleyrat
- Related entities
- 14 observables, 1 intrusion sets (apt), 16 techniques (mitre), 1 malware, 11 others
Description
Silver Fox, a threat actor, is exploiting Japan's tax filing and organizational change season with a targeted spearphishing campaign against Japanese businesses. The group sends convincing phishing emails related to tax compliance, salary adjustments, and HR matters, tricking recipients into opening malicious links or attachments. The campaign capitalizes on the high volume of legitimate financial and HR communications during this period, increasing the risk of compromise. Silver Fox has expanded its targets from Chinese-speaking entities to Southeast Asia, Japan, and potentially North America. The group uses ValleyRAT, a remote access trojan, to gain control of compromised machines and steal sensitive information. To protect against this threat, organizations should increase vigilance, reinforce awareness about phishing attempts, and verify the authenticity of tax- and HR-themed requests.