Silver Fox
Also known as SilverFox, Yinhu, 银狐
Reports
12
First seen
Mar 27, 2026
Last seen
Sep 2, 2026
Motivation
Financial, Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Victim regions
×1×3
China×3
Japan×2
United States×1
India×1
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1566 Phishing ×8T1562.001 Impair Defenses: Disable or Modify Tools ×6T1005 Data from Local System ×5T1204 User Execution ×5T1059 Command and Scripting Interpreter ×5T1113 Screen Capture ×4T1071.001 Application Layer Protocol: Web Protocols ×4T1218 System Binary Proxy Execution ×4T1055 Process Injection ×3T1547.001 Registry Run Keys / Startup Folder ×3T1112 Modify Registry ×3T1547 Boot or Logon Autostart Execution ×3
Indicators
cve ×108filename ×65domain ×49ip_v4 ×17hash_md5 ×12hash_sha256 ×7registry_key ×4url ×4
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2018-5999 (exploited)CVE-2024-9643 (exploited)CVE-2026-0300 (exploited)CVE-2026-20223CVE-2026-41091 (exploited)CVE-2026-45498 (exploited)CVE-2026-45585CVE-2026-46333CVE-2026-4670CVE-2026-5174CVE-2026-66747 (exploited)CVE-2026-6973 (exploited)CVE-2026-74232 (exploited)CVE-2026-74233 (exploited)CVE-2026-81578 (exploited)CVE-2026-82078 (exploited)CVE-2026-9082 (exploited)
Recent reports
High