Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in India and Russia

Silver Fox cybercrime group deployed ABCDoor malware targeting organizations in Russia and India through tax-themed phishing campaigns.

• •Tax-themed phishing emails mimicked Income Tax Department notices, with malicious archives containing RustSL Rust-based loader
• •ABCDoor is a Python-based backdoor delivered via ValleyRAT plugin, active since December 2024
• •RustSL implements geofencing, sandbox detection, and Phantom Persistence technique for maintaining system persistence
• •Attack chain uses encrypted payloads and custom modules for C2 communications, data exfiltration, and remote access
• •Campaign impacted over 1,600 organizations across industrial, consulting, retail, and transportation sectors between January-February