Chinese Hacker Group Leverages Fake Websites to Deploy Sainbox RAT and Hidden Rootkit

TL;DR

• The Chinese hacking group Silver Fox is using fake software websites to distribute Sainbox RAT and the Hidden rootkit.
• The campaign’s tactics are similar to previous activities attributed to Silver Fox, also known as Void Arachne.

Introduction

A new cyber campaign has been identified, utilizing counterfeit websites to distribute popular software such as WPS Office, Sogou, and DeepSeek. These deceptive sites are used to deliver Sainbox RAT (Remote Access Trojan) and the open-source Hidden rootkit. The campaign has been linked to the Chinese hacking group Silver Fox (also known as Void Arachne) with medium confidence, based on similarities in tactics and techniques observed in previous campaigns.

Campaign Overview

Targeted Software and Distribution Method

The hacking group has set up fake websites that mimic popular software platforms, including WPS Office, Sogou, and DeepSeek. Unsuspecting users are lured to these sites, where they unintentionally download malicious software bundled with Sainbox RAT and the Hidden rootkit.

Malware Details

• Sainbox RAT: This Remote Access Trojan allows attackers to gain control over infected systems, enabling them to execute various malicious activities remotely.
• Hidden Rootkit: An open-source rootkit designed to hide the presence of malware on compromised systems, making detection and removal more challenging.

Attribution to Silver Fox

The campaign’s tactics and techniques show strong similarities to previous activities attributed to Silver Fox, also known as Void Arachne. These similarities include the use of fake websites, the distribution of specific malware types, and the targeted software platforms. The attribution is made with medium confidence, indicating a likely but not definitive connection.

Implications and Recommendations

Potential Impact

The use of fake websites to distribute malware poses significant risks to users and organizations. Compromised systems can be exploited for various malicious activities, including data theft, espionage, and further malware distribution. The Hidden rootkit’s ability to conceal malware makes detection and mitigation more complex, highlighting the importance of robust cybersecurity measures.

Mitigation Strategies

• User Awareness: Educate users about the risks of downloading software from unverified sources.
• Security Solutions: Implement advanced security solutions capable of detecting and mitigating sophisticated threats.
• Regular Updates: Ensure that all software and security solutions are up-to-date to protect against known vulnerabilities.

Conclusion

The ongoing campaign by Silver Fox underscores the evolving tactics used by cyber threat actors. By leveraging fake websites to distribute malware, the group demonstrates a sophisticated approach to compromising user systems. Vigilance and proactive security measures are crucial in defending against such threats.

Additional Resources

For further insights, check: source