Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains

This article covers the Silver Fox (SwimSnake) threat group's expanded Asia cyber campaign using a newly discovered AtlasCross RAT delivered via typosquatted domains.

• •Eleven fake domains impersonating brands like Surfshark VPN, Signal, Telegram, Zoom, and Microsoft Teams were registered on October 27, 2025 to distribute malware
• •AtlasCross RAT evolves from Gh0st RAT derivatives (ValleyRAT/Winos 4.0) and embeds the PowerChell framework, a native C/C++ PowerShell engine that disables AMSI, ETW, and ScriptBlock logging
• •C2 traffic is encrypted with ChaCha20 using per-packet random keys generated via hardware RNG
• •The RAT supports DLL injection into WeChat, RDP session hijacking, and active TCP-level termination of connections from Chinese security products like 360 Safe and Huorong