DNS Spotlight: The Silver Fox in the Henhouse

Disguised as Russian threat actors, Chinese APT group Silver Fox managed to infiltrate well-protected targets. They used Cyrillic characters in their SEO poisoning campaign lures that deployed ValleyRAT¹ into target networks.

Silver Fox abused Microsoft Teams to install ValleyRAT into victims’ systems to conduct state-sponsored espionage for sensitive intelligence and engage in financial fraud and theft to fund their operations.²

ReliaQuest originally identified 41 IoCs comprising six domains, 17 subdomains, and 18 IP addresses after analyzing the cyber attack in great depth. We investigated the Silver Fox infrastructure further and jumping off 55 IoCs in total unearthed these discoveries:

• 2,357 unique client IP addresses communicated with one domain identified as an IoC
• Four domains identified as IoCs were bulk-registered with 3–4 look-alikes each
• Seven domains identified as IoCs were deemed likely to turn malicious 239–339 days before they were dubbed as such
• One potential victim IP address communicated with one domain identified as an IoC
• 45,949 email-connected domains, 51 of which turned out to be malicious
• Seven additional IP addresses, all of which turned out to be malicious
• 20 IP-connected domains
• 30 string-connected domains, one of which turned out to be malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://main.whoisxmlapi.com/threat-reports/predicting-valleyrat-with-first-watch
• [2] https://reliaquest.com/blog/threat-spotlight-silver-foxs-russian-ruse-fake-microsoft-teams-attack/