{"id":239001,"date":"2026-05-04T07:57:00","date_gmt":"2026-05-04T11:57:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/04\/silver-fox-deploys-abcdoor-malware-via-tax-themed-phishing-in-india-and-russia\/"},"modified":"2026-05-04T13:30:09","modified_gmt":"2026-05-04T17:30:09","slug":"silver-fox-deploys-abcdoor-malware-via-tax-themed-phishing-in-india-and-russia","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/04\/silver-fox-deploys-abcdoor-malware-via-tax-themed-phishing-in-india-and-russia\/","title":{"rendered":"Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in India and Russia"},"content":{"rendered":"

Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in India and Russia<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/05\/silver-fox-deploys-abcdoor-malware-via.html<\/a><\/p>\n

Publish Date: 2026-05-04 07:57:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

\ue804Ravie Lakshmanan<\/span>\ue802May 04, 2026<\/span><\/span>Malware \/ Network Security<\/span><\/p>\n

The China-based cybercrime group known as Silver Fox<\/strong> has been linked to a new campaign targeting organizations in Russia and India with a new malware called ABCDoor<\/strong>.<\/p>\n

The activity involved using phishing emails that mimic correspondence from the Income Tax Department of India in December 2025, followed by a similar campaign aimed at Russian entities.<\/p>\n

“Both waves followed a nearly identical structure: phishing emails were styled as official notices regarding tax audits or prompted users to download an archive containing a ‘list of tax violations,'” Kaspersky said. “Inside the archive was a modified Rust-based loader pulled from a public repository. This loader would download and execute the well-known ValleyRAT backdoor.”<\/p>\n

The campaign is estimated to have impacted organizations across the industrial, consulting, retail, and transportation sectors. More than 1,600 phishing emails were flagged between early January and early February.<\/p>\n

What’s notable about these phishing waves is the delivery of a new ValleyRAT plugin that functions as a loader for a previously undocumented Python-based backdoor codenamed ABCDoor. The backdoor, per the Russian cybersecurity company, has been part of the threat actor’s arsenal since at least December 19, 2024, and was put to use in cyber attacks beginning February or March 2025.<\/p>\n

The starting point of the attack chain is a phishing email containing a PDF file, which features two clickable links that lead to the download of a ZIP or RAR archive hosted on “abc.haijing88[.]com.” In the campaign detected in December 2025, the malicious code is said to have been embedded directly within the files attached to the email.<\/p>\n

Present within the archive is an executable that mimics a PDF file. The binary is a modified version of an open-source shellcode loader and antivirus bypass framework called RustSL. Silver Fox’s first recorded use of RustSL dates back to late December 2025.<\/p>\n

The…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in India and Russia https:\/\/thehackernews.com\/2026\/05\/silver-fox-deploys-abcdoor-malware-via.html Publish Date:…<\/p>\n","protected":false},"author":1,"featured_media":239002,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgjfw7HlDQIzbgA8xy1bk-sUkn-TVS85DGaL4vQkuTNYu3SGabQGuPKBD7C1qkCcpxwEFfdW6I9DJoSnmMmbkAu24SN1R_B2HNYwi-niSiST1LJqwMQ7tspMjxMyHXJtZUxGZbb2Hb1k-_2ywcG5hWFhOKQubJsYXiq8hyphenhyphenFfLyVewIet_ZcdTmNZEc9-Fum\/s1600\/godd.png","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,32,29,25,34],"class_list":["post-239001","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-malware","tag-network-security","tag-phishing","tag-threat-actor"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/239001"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=239001"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/239001\/revisions"}],"predecessor-version":[{"id":239003,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/239001\/revisions\/239003"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/239002"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=239001"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=239001"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=239001"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}