Kaspersky\u2019s Global Research & Analysis Team (GReAT) has analysed several new waves of cyberattacks conducted by the SilverFox group, observed since December 2025. The campaign targeted companies in South Africa \u2013 as well as India, Indonesia and Russia \u2013 across industrial, consulting, trade and transportation sectors. <\/p>\n\n\n\n
The phishing emails were crafted to appear as official tax audit notifications or to prompt recipients to download an archive purportedly containing a \u2018list of tax violations\u2019. By leveraging the perceived authority and urgency of communications from tax agencies, the threat actor aimed to persuade victims to download the file and trigger the attack chain. Between January and February alone, more than 1,600 malicious emails were recorded. <\/p>\n\n\n\n
The threat actor expanded its toolkit by deploying a new Python-based backdoor, dubbed ABCDoor, via the previously known ValleyRAT backdoor used in earlier attacks. ABCDoor was present in the APT arsenal from the end of 2024 and was used in attacks throughout 2025. It enables attackers to upload and download files, and also to remotely control infected systems by streaming multiple victim screens simultaneously in near real time, accessing the clipboard and updating itself. In addition, a modified and previously undocumented version of RustSL was used to deliver ValleyRAT, first deployed by the threat actor in late December 2025. <\/p>\n\n\n\n
Anton Kargin, Senior Security Researcher in Kaspersky GReAT, said: \u201cSocial engineering played a key role in this campaign. The group exploited users\u2019 tendency to trust communications from official agencies, such as tax authorities. At the same time, SilverFox employed a multi-stage delivery approach for the primary malicious payload and utilised multiple email addresses and domains. This increases the overall risk posed by such attacks, as it helps minimise the likelihood of detection and disruption across the attack chain.\u201d <\/p>\n\n\n\n
To stay safe, Kaspersky recommends organisations to: <\/p>\n\n\n\n
Kaspersky\u2019s Global Research & Analysis Team (GReAT) has analysed several new waves of cyberattacks conducted by the SilverFox group, observed since December 2025. The campaign targeted companies in South Africa \u2013 as well as India, Indonesia and Russia \u2013 across industrial, consulting, trade and transportation sectors. The phishing emails were crafted to appear as official tax audit notifications or to prompt recipients to download an archive purportedly containing a \u2018list of tax violations\u2019. By leveraging the perceived authority […]<\/p>\n","protected":false},"author":2418,"featured_media":80467,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[15417,9059,13],"tags":[388,9201,226,101,1415,453,849],"class_list":["post-80466","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-south-africa","category-top-stories","tag-cybersecurity","tag-great","tag-kaspersky","tag-malware","tag-phishing","tag-south-africa","tag-threat-intelligence"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/80466","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/users\/2418"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/comments?post=80466"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/80466\/revisions"}],"predecessor-version":[{"id":80468,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/80466\/revisions\/80468"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media\/80467"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media?parent=80466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/categories?post=80466"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/tags?post=80466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}