Cybersecurity researchers have uncovered a sophisticated campaign targeting Chinese-speaking users through fake websites promoting popular software applications. The attack, attributed to the Chinese hacking group Silver Fox (also known as Void Arachne), demonstrates an evolving threat landscape focused on the Chinese market.

## The Attack Strategy

The campaign operates by creating fraudulent websites that mimic legitimate software distributors. These sites advertise well-known applications including WPS Office, Sogou, and DeepSeek to lure unsuspecting users. The primary attack vector uses a fake domain “wpsice[.]com” to distribute malicious MSI installers written in Chinese, clearly targeting Chinese-speaking populations.

## Technical Execution

Once users download what they believe is legitimate software, the malicious MSI installer initiates a complex infection chain:

1. **Initial Execution**: The installer launches a legitimate file called “shine.exe”
2. **DLL Side-loading**: This process loads a malicious DLL file “libcef.dll” using side-loading techniques
3. **Payload Extraction**: The rogue DLL extracts shellcode from a text file (“1.txt”) within the installer
4. **Final Deployment**: The shellcode executes the main payload – Sainbox RAT, a variant of the notorious Gh0st RAT

## Malware Capabilities

The campaign deploys two primary malicious tools:

**Sainbox RAT** provides attackers with:
– Remote access to infected systems
– Data theft capabilities
– Ability to download additional malware payloads

**Hidden Rootkit** offers stealth features including:
– Concealment of malware processes
– Hiding Windows Registry modifications
– Advanced evasion techniques to avoid detection

## Pattern of Attacks

This campaign represents a continuation of Silver Fox’s established tactics. Previous operations include:
– **July 2024**: Fake Google Chrome sites distributing Gh0st RAT
– **February 2024**: Bogus browser sites spreading ValleyRAT (Winos 4.0)
– **September 2023**: Campaigns targeting Chinese users with Sainbox RAT and Purple Fox malware

## Strategic Implications

According to Netskope Threat Labs researcher Leandro Fróes, the attackers’ use of commodity RATs and open-source rootkits provides them with “control and stealth without requiring a lot of custom development.” This approach allows threat actors to maintain sophisticated capabilities while minimizing development costs and complexity.

The consistent targeting of Chinese-speaking users suggests either a focused intelligence-gathering operation or preparation for broader cyber espionage activities within Chinese-speaking communities worldwide.

This campaign highlights the importance of downloading software only from official sources and maintaining updated security solutions capable of detecting advanced persistent threats.