Adversary Intelligence — 2026-05-05

China-Based Silver Fox Group Deploys New ABCDoor Backdoor in Tax-Themed Campaign Targeting Russia and India

Kaspersky on May 4 reported a campaign by China-based Silver Fox that sent over 1,600 phishing emails between early January and early February 2026, impersonating Indian and Russian tax authorities to deliver a new Python-based backdoor designated ABCDoor. Silver Fox's modified RustSL loader downloads ValleyRAT, which then deploys ABCDoor; the backdoor communicates over HTTPS and supports remote control, screen broadcasting, clipboard exfiltration, and a shutdown-intercept persistence technique Kaspersky designates Phantom Persistence. Kaspersky noted ABCDoor has been in Silver Fox's toolkit since at least late December 2024, with confirmed operational use from early 2025 onward. India accounts for roughly 65 percent of loader detections per Security Online's coverage of the same Kaspersky data, with Russia and Indonesia trailing; Silver Fox recently extended the malware's geofencing to include Japan.

Analysis
ABCDoor's Phantom Persistence mechanism signals design intent to survive first-responder containment rather than passive anti-analysis. Clipboard and screen-broadcasting capabilities profile it as a credential and document harvester consistent with the financial-intelligence logic of tax-authority impersonation. China simultaneously targeting Russia and India under unified campaign infrastructure reinforces documented patterns of Chinese intelligence collecting against nominally aligned states. Silver Fox's geofencing extension to Japan broadens the group's aperture toward U.S. alliance network targets. The 65 percent India detection skew, from a single Kaspersky report, may reflect Kaspersky's regional customer base rather than actual targeting priorities. Kaspersky's indicator publication now gives the research community a detection baseline, making additional public ABCDoor attribution likely within 90 days.

4 sources

Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India - Kaspersky Securelist
Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in India and Russia - The Hacker News
Silver Fox Springs Tax-Themed Attacks on Orgs in India, Russia - Dark Reading
Tax Audit Trap: Silver Fox Unleashes "ABCDoor" via Modified Rust Loaders - Security Online