Loading malware…
SilentRunLoader is a Python-based loader and information stealer associated with the Chinese-speaking, financially motivated threat cluster TA4922, which has overlap with the broader Silver Fox ecosystem. It has been used in campaigns targeting organizations in the United Kingdom and Southeast Asia, particularly through localized tax, benefits, compliance, and other business-themed social-engineering lures. Delivery has been observed via phishing emails and DLL sideloading, often as part of broader intrusion chains intended to establish access, steal data, and stage additional tooling.
The malware combines loader and browser-theft functionality. It is used to stage additional payloads while also harvesting data from Google Chrome, including stored credentials, cookies, and browsing information. Reported behavior includes collecting browser data, packaging stolen information for upload, exfiltrating it to attacker-controlled infrastructure, and downloading or dropping an additional executable as a next-stage component. This dual-use design makes it both an access-enablement tool and a direct data-theft mechanism.
SilentRunLoader has been linked to campaigns in which TA4922 impersonated tax authorities and other trusted business functions to increase victim interaction. Its use reflects the actor’s broader pattern of localized phishing, rapid tooling iteration, and reliance on DLL sideloading and legitimate services to reduce detection. Researchers have also assessed with high confidence that some newer Python malware in this toolkit, including SilentRunLoader, was likely developed with assistance from large language models, based on coding artifacts and placeholder values. Within TA4922 operations, SilentRunLoader represents a notable evolution toward quickly produced, multifunctional malware focused on browser data theft and follow-on payload delivery on Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recent campaigns delivered a newly identified backdoor, Atlas RAT, alongside two fresh loader families Proofpoint named RomulusLoader and SilentRunLoader...
The disclosure comes as Silver Fox continues to actively refine and expand its arsenal with new tools, such as Atlas RAT (aka AtlasCross RAT), RomulusLoader, and SilentRunLoader...
14 distinct techniques documented for this family, organized by ATT&CK tactic.
In recent months, however, attacks mounted by the hacking group have relied on phishing campaigns using human resources- and business-themed lures for credential phishing, fraud, and malware delivery, including Atlas RAT, RomulusLoader, and SilentRunLoader.
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader mentioned as part of Silver Fox's expanding arsenal.
A loader malware family listed as part of Silver Fox's expanding arsenal.
A compiled Python malware utility that steals browser data from Google Chrome, including saved credentials, session cookies, and browsing history, archives the data, and uploads it to a remote server. The report suggests it may have been rapidly developed with LLM assistance.
A loader family introduced in TA4922 campaigns to stage additional tools.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.