Silver Fox campaign uses trojanized medical software
Picus describes a Silver Fox campaign that concealed malware in modified Windows software. Running it could give attackers remote access, record keystrokes, consume resources for cryptocurrency mining and weaken security monitoring.
- Report priority
- High
- Involves
- Microsoft Windows systems that execute the trojanized software
What is known
- To be infected through the documented chain, a Windows user must run a trojanized application, such as the observed fake Philips DICOM viewer.
- Picus says the delivery route was likely search-result manipulation or phishing, but it doesn't confirm which route delivered that sample.
- The loader contacts attacker-controlled Alibaba Cloud storage and downloads encrypted second-stage files.
- It then adds broad Microsoft Defender exclusions and uses a vulnerable driver to terminate security processes.
- Later stages install ValleyRAT for remote access, along with a keylogger and cryptocurrency miner.
What to do
First, ask your IT or endpoint security team to determine where MediaViewerLauncher.exe or related DICOM viewer packages came from and whether users ran them. Have the team review endpoint telemetry for Defender exclusions covering C:\, C:\ProgramData, C:\Users, C:\Users\Public or C:\Program Files (x86), unexpected logon-triggered scheduled tasks, and the 189atohci.sys driver. Any match needs incident-response review, although one artifact alone may require validation. No result in one log source doesn't prove the computer is clean.
Picus recommends allowing only trusted software from verified sources, restricting software installation, monitoring endpoints, enabling PowerShell logging and blocking known vulnerable drivers. If checks find indicators, give the host name, user, file path, download source and timestamps to your incident-response or IT security team so they can investigate, contain the infection and remove the malware. Installing legitimate software or updates alone does not confirm that an earlier infection was removed.
Reported details
An employee searches for Microsoft Edge or Razer software and clicks a top search result that looks like the real vendor page. The site serves a fake installer, and the archive's file hash changes with every single download so antivirus tools that block known bad files miss it. Once run, the installer creates a scheduled task disguised with a bland name like 'Deadline Mission Target,' then briefly runs as SYSTEM to add Windows Defender exclusions, stop Windows Update, and delete the shadow copies used for recovery.
Picus described this Silver Fox campaign on June 18, 2025. It also identifies the group as Void Arachne or The Great Thief of Valley. The observed MediaViewerLauncher.exe chain retrieved encrypted components from Alibaba Object Storage, created scheduled tasks and deployed ValleyRAT, also called Winos 4.0. It used the vulnerable 189atohci.sys driver, described by Picus as TrueSightKiller, to terminate antivirus and endpoint security processes.
Picus confirmed the malware chain but described delivery through manipulated search results or phishing as likely.