- Joined
- Jan 22, 2026
- Messages
- 101
- Reaction score
- 921
The intruders figured out how to get inside without making too much noise.
Taiwan has recorded a series of targeted attacks using an updated version of the Winos 4.0 malware tool, also known as ValleyRat. The campaigns are built around phishing emails and forged documents that disguise themselves as official notices of tax audits and electronic invoices. According to FortiGuard Labs specialists, the attacks are characterized by a well-thought-out infrastructure and the active use of methods to circumvent Windows security mechanisms.
The attackers send out archives with files designed as tax documents. Inside there is an LNK shortcut and a bait in the form of a harmless file. After launching, the shortcut invokes the system command interpreter and downloads the next stage of the attack from the external domain. Renaming the standard utility is used for masking. curl.exe , which helps to bypass simple filtering by file name. The downloaded installer extracts the hidden executable component and places it in the ProgramData directory, laying the foundation for further downloading of Winos 4.0 and a driver that helps hide the activity.
In the second wave of attacks, a different approach was applied. Instead of shortcuts, archives with a legitimate application and a malicious library are distributed, which is loaded through the sideloading DLL mechanism. The links in the emails mimic the official addresses of Taiwan's tax authorities, but lead to cloud storage facilities in mainland China. An analysis of the service paths inside the malicious library revealed the mention of the "大馬專案(二)" project, which indicates the structured organization of the attacking group's work.
After being fixed in the system, Winos 4.0 checks for administrator rights and, if necessary, bypasses account control through a combination of AppInfo service calls and Debug Object interception. Then the Bring Your Own Vulnerable Driver technique is used. A signed driver is loaded into the system wsftprm.sys , the vulnerabilities of which allow you to obtain kernel-level privileges and disable security features.
The malicious module analyzes running processes and shuts down antivirus and protection systems, including Microsoft Defender, Trend Micro solutions, Symantec, 360 and others. The address of the management server is hidden in the code as a Base64 string, and after decryption, a connection is established with node 47.76.86.151. Additional plug-ins responsible for file management, remote access, and screen capture are stored directly in the registry and work in memory without creating noticeable files on disk.
An analysis of the domain registration data showed a connection with the name Li Jiqiang and an email address associated with a university domain in China. The metadata of the malicious files also contains the machine ID, which previously appeared in the activity of the Silver Fox group in the summer of 2025. The coincidence of infrastructure, driver loading methods, and the management server allows you to link current campaigns with the same Silver Fox division.
Experts believe that the attacks will continue. The group is actively changing domains and delivery methods, relying on localized baits and in-memory execution of modules. Such tactics complicate detection and increase the risk of compromising corporate networks.
Taiwan has recorded a series of targeted attacks using an updated version of the Winos 4.0 malware tool, also known as ValleyRat. The campaigns are built around phishing emails and forged documents that disguise themselves as official notices of tax audits and electronic invoices. According to FortiGuard Labs specialists, the attacks are characterized by a well-thought-out infrastructure and the active use of methods to circumvent Windows security mechanisms.
The attackers send out archives with files designed as tax documents. Inside there is an LNK shortcut and a bait in the form of a harmless file. After launching, the shortcut invokes the system command interpreter and downloads the next stage of the attack from the external domain. Renaming the standard utility is used for masking. curl.exe , which helps to bypass simple filtering by file name. The downloaded installer extracts the hidden executable component and places it in the ProgramData directory, laying the foundation for further downloading of Winos 4.0 and a driver that helps hide the activity.
In the second wave of attacks, a different approach was applied. Instead of shortcuts, archives with a legitimate application and a malicious library are distributed, which is loaded through the sideloading DLL mechanism. The links in the emails mimic the official addresses of Taiwan's tax authorities, but lead to cloud storage facilities in mainland China. An analysis of the service paths inside the malicious library revealed the mention of the "大馬專案(二)" project, which indicates the structured organization of the attacking group's work.
After being fixed in the system, Winos 4.0 checks for administrator rights and, if necessary, bypasses account control through a combination of AppInfo service calls and Debug Object interception. Then the Bring Your Own Vulnerable Driver technique is used. A signed driver is loaded into the system wsftprm.sys , the vulnerabilities of which allow you to obtain kernel-level privileges and disable security features.
The malicious module analyzes running processes and shuts down antivirus and protection systems, including Microsoft Defender, Trend Micro solutions, Symantec, 360 and others. The address of the management server is hidden in the code as a Base64 string, and after decryption, a connection is established with node 47.76.86.151. Additional plug-ins responsible for file management, remote access, and screen capture are stored directly in the registry and work in memory without creating noticeable files on disk.
An analysis of the domain registration data showed a connection with the name Li Jiqiang and an email address associated with a university domain in China. The metadata of the malicious files also contains the machine ID, which previously appeared in the activity of the Silver Fox group in the summer of 2025. The coincidence of infrastructure, driver loading methods, and the management server allows you to link current campaigns with the same Silver Fox division.
Experts believe that the attacks will continue. The group is actively changing domains and delivery methods, relying on localized baits and in-memory execution of modules. Such tactics complicate detection and increase the risk of compromising corporate networks.
THE UNDERGROUND ARCHIVES 
Classified Files
Encrypted Communications
Dark Storylines
