Kaspersky’s GReAT identified a new wave of cyberattacks by the SilverFox group since December 2025, targeting companies across multiple sectors in India, Indonesia, South Africa, and Russia. The campaign used phishing emails disguised as tax audit notices to trick victims into downloading malicious files, with over 1,600 emails recorded early in 2026. Attackers deployed a Python-based backdoor, ABCDoor, via ValleyRAT, enabling remote control, file access, and real-time screen monitoring. A modified version of RustSL was also used to deliver malware, indicating an expanded and evolving attack toolkit, a press release said.
“Social engineering played a key role in this campaign. The group exploited users’ tendency to trust communications from official agencies, such as tax authorities. At the same time, SilverFox employed a multi-stage delivery approach for the primary malicious payload and utilized multiple email addresses and domains. This increases the overall risk posed by such attacks, as it helps minimize the likelihood of detection and disruption across the attack chain,” says Anton Kargin, senior security researcher in Kaspersky GReAT.
Previously, SilverFox targeted enterprises in Asia in sectors including telecommunications, energy, logistics and finance.
Read the full report on Securelist.com to learn more about the APT new campaign and its toolset.
Kaspersky advises organizations to strengthen cybersecurity by training employees to improve digital literacy, using email security solutions to block suspicious messages and scan archives, equipping teams with threat intelligence to track evolving tactics, and deploying advanced protection platforms that ensure real-time monitoring, visibility, investigation, and rapid response across corporate infrastructure.
